DirectAdmin: How to Patch PHP CVE-2026-109618 & CVE-2026-109619 (Critical RCE)

Disclosed 21 October 2026. Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated remote code execution. On DirectAdmin, PHP is compiled by CustomBuild, so you patch it by rebuilding PHP to a fixed release. Your sites' files and databases are not touched.

Using cPanel? Follow the cPanel & CloudLinux guide. Using Plesk? See the Plesk guide.

Fixed PHP versions

Run as root:

This lists every PHP version CustomBuild manages on your server, with the installed and the latest available release. You can also check one version directly — DirectAdmin installs each PHP under

/usr/local/phpXY

/usr/local/php83/bin/php -v

(Use php82, php84, php85 and so on for your other versions.) Anything older than the table above needs the update.

da build update
da build php

da build update refreshes CustomBuild's list of available versions so it knows about the fixed releases. da build php then rebuilds every PHP version configured on the server. Compiling takes roughly 10–30 minutes per PHP version; websites keep running and PHP restarts briefly at the end.

Older DirectAdmin servers that don't have the da command use the same steps from the CustomBuild folder:

cd /usr/local/directadmin/custombuild
./build update
./build php

Run the Step 1 check again. Every PHP version should now show a version from the table above. If a website still reports the old version, restart that version's PHP-FPM service (replace 83 with your version):

systemctl restart php-fpm83

CloudLinux servers (ALT-PHP)

If your DirectAdmin server runs CloudLinux, sites can also use ALT-PHP (selected in the PHP Selector). Those packages are separate from CustomBuild — update them too:

yum update 'alt-php*'

Check them with:

Any line showing "NOT fixed yet" still needs the update.

End-of-life PHP (7.4 / 8.0 / 8.1)

The PHP project no longer releases updates for 8.1 and older, so CustomBuild cannot build a fixed version of them. You have two options:

• Move the sites to a supported PHP version (recommended). For example, to switch the primary PHP to 8.3:

  Terminal

  Copy

  da build set php1_release 8.3
  da build php
  da build rewrite_confs

  Check that your applications support the newer PHP version first.

• CloudLinux servers: keep an older version through ALT-PHP with Extended Life Support (ELS), which is included with a CloudLinux licence from us. Enable it with

  Terminal

  Copy

  tslzCLN --tuxcare

  , then run
  Terminal

  Copy

  yum update 'alt-php*'

  and switch the affected sites to that ALT-PHP version in the PHP Selector.

• The build stops with a download or compile error: run da build update again and retry da build php. Make sure the server has free disk space (df -h) — compiling PHP needs room in
  Terminal

  Copy

  /usr/local

  and
  Terminal

  Copy

  /tmp

  .
• da build versions still shows an old "latest" version: CustomBuild's version list hasn't been refreshed yet — run da build update first.

Want us to patch it for you?

Open a ticket and share server access — our team will apply the update, restart PHP and verify every version for you.