PHP Security Vunerability Updates for CVE-2026-109618 and CVE-2026-109619

On October 21, 2026, PHP released updates that addressed two critical vulnerabilities: CVE-2026-109618  and CVE-2026-109619. Details can be found here: https://www.php.net/index.php#2026-10-20-1

Updating InterWorx’s Internal PHP Version

At  2:45 EST on October 21, 2026, we released an update to the internal PHP versions for InterWorx 7 (iworxphp72-php) and InterWorx 8 (iworxphp82-php).  The updated versions are:

• InterWorx 7, on EL8: iworxphp72-php-7.2.34-114
• InterWorx 8, on EL8 and EL9: iworxphp82-php-8.2.35-4

Note: As our public support for EL7 ended December 31, 2025, we will not be providing updates to InterWorx 7 on EL7. It is recommended that any server still using EL7 migrate to a supported environment, immediately.

On a standard InterWorx installation, the update to the iworxphp package will be pulled in the next time the daily cron runs on the server.

However, due to the severity of this vulnerability, we strongly recommend performing a manual update as soon as possible. 

1. Log in to the server at the CLI as root, either via SSH or from the terminal

2. At the CLI, run the following command to check the current iworxphp version

• On InterWorx 7:

  rpm -qi iworxphp72-php

• On InterWorx 8:

  rpm -qi iworxphp82-php

3. If the version listed in the command output does not match the corresponding version listed, above, run the following to install the updated version:

     yum clean all
     yum update *.iworx.*

Updating the server and domain-level PHP versions

Updates to the system PHP version, as well as the versions of PHP provided by the multiple PHP tool, are OS-level updates. If OS updates are enabled in NodeWorx under Server > Software Updates, updates to these versions should be pulled in during the next daily cron.

However, again, due to the severity of the vulnerability we strongly recommend updating manually, as soon as possible.

1.  Log in to the server at the CLI as root, either via SSH or from the terminal

2. At the CLI, run the following:

   yum clean all 
   yum update

Any domains using a version of PHP lower than 7.4 must be moved to a more up-to-date version. 

Information on managing domain-level PHP versions can be found here:

• IW8:
  • How to install versions provided by the multiple php tool (versions available are determined by OS, not InterWorx version): https://appendix.interworx.com/current/nodeworx/webserver/php_options/enable-multiple-php-nodeworx-siteworx.html#to-install-multiple-php-versions
  • How to enable multiple php versions so SiteWorx accounts have access to them: https://appendix.interworx.com/current/nodeworx/webserver/php_options/enable-php-versions-siteworx.html
  • How to change the PHP version for a domain: https://appendix.interworx.com/current/siteworx/domains_and_websites/php/change-php-versions.html
• IW7:
  • How to  install versions provided by the multiple php tool and enable multiple php versions so SiteWorx accounts have access to them: https://appendix.interworx.com/7.14/nodeworx/webserver/php_options/enable-multiple-php-nodeworx-siteworx.html
    
  • How to change the PHP version for a domain: https://appendix.interworx.com/7.14/siteworx/domains_and_websites/php/change-php-versions.html
• These changes can also be made in bulk at the CLI, if needed (this documentation is the same for both InterWorx versions): https://appendix.interworx.com/current/nodeworx/webserver/php_options/how-to-make-bulk-changes-to-siteworx-account-php-versions.html