What ServerPilot has said about the fix, and where to update and restart PHP in it.
What ServerPilot says
No ServerPilot statement found on the blog; newest post is 8 May 2026 and none mention PHP CVE-2026-109618. ServerPilot docs say PHP packages are provided by ServerPilot; they do not say whether patch updates to installed versions are automatic.