Upcoming Critical PHP Security Release
Php just announced a upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC
It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
How can we update the php versions on our servers? it's a general update or easyphp? Do we have to wait for cpanel patches?
-
Hope to find the next release of PHP on tomorrow's Cpanel release!
0 -
Yeah, this sounds like a pretty critical issue so hopefully this is prioritized and released asap!
0 -
And it got leaked: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
@cPanel, what is the action plan here, how fast will the fix be released?0 -
Please note that updates will only be released for PHP 8.2 and later versions; there are no patches for older versions. You will need to use paid "hardened php" solutions.
Good luck...
0 -
Yes, but we need to know how long cPanel will take, if it is going to take hours, then I will rather restrict port 443 and 80, clients must understand.
0 -
mitigation advice at least?
0 -
Any comment from cPanel would be appreciated
0 -
any update?
0 -
cPRex could you please update us? We are an hour away from the patch being released from PHP, can you please let us know what cPanel plan/timeline is? We are paying a lot of money to cPanel, and these are the things we are concerned about, not new sell up things in cPanel. I cant believe there has been no announcement from cPanel, I have been receiving emails from every product, data center, and even developers companies regarding this. Nothing from our Vendor.
0 -
UPDATE - at this point we're releasing updates for ea-php74, ea-php80, ea-php81, ea-php82, ea-php83, ea-php84, ea-php85. We're ready to go on our side as soon as PHP lifts the embargo, so it could be any given moment at this point.
This will be released as a security update so it will reach your server within an hour.
0 -
cPRex thanks for the update. Does this include servers using Imunify360, PHP Hardened and/or Cloudlinux?
1 -
cPRex thank you so much for the information
0 -
It's good news that updates will be provided for php versions up to 7.4. @cPRex
0 -
We have one server on Cpanel 110 that's stuck because of Cent OS 7. Will the php 7.4 be rolled out for those?
0 -
CloudLinux notice (hardened PHP/Imunify) https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619
0 -
cPRex:
My upcp --security also got updated packages for ea-php54, ea-php55 and ea-php56, can you please verify if these are safe too?0 -
UPDATE - the updates are released, although we did introduce some staggering to help with the load on the update servers. This means you'll still receive the update quickly, but your machines may not get it all at the same time.
The specific updated versions are listed here:
8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33
0 -
Do security updates go out automatically or do we need to run cPanel update process? What test can we do on a box to confirm the patch was applied? Command line outputs appreciated.
0 -
yeah more information on updating please
0 -
This is released as part of our security update system so you don't need to do anything. If you want to manually update you can always perform "/scripts/upcp" or a "yum update" on the system to get the latest packages.
0 -
We have sites offline until we can confirm the patch has been applied, so a verification command via command line is needed.
0 -
The best way to check if things are updated would be to check for the presence of the package of the specific PHP version that you're using. Something along these lines would work - just modify the version ## for your system:
rpm -qa | grep ea-php##
and look for the updated version number there.
0 -
cPRex my upcp --security also got updated packages for ea-php54, ea-php55 and ea-php56, can you please verify if these are safe too?
0 -
No, those older versions are not included in the update, at least from cPanel or PHP directly.
0 -
cpanel upcp or
yum upgradewill update php.After check;
[root@server]# rpm -q --changelog ea-php74-php-cli
* Tue Oct 20 2026 Cory McIntire <cory.mcintire@webpros.com> - 7.4.33-19
- EA-13613: Backport fix for CVE-2026-109618 and CVE-2026-109619[root@server]# rpm -q --changelog ea-php81-php-cli
* Tue Oct 20 2026 Cory McIntire <cory.mcintire@webpros.com> - 8.1.34-5
- EA-13611: Backport fix for CVE-2026-109618 and CVE-2026-109619[root@server]# rpm -q --changelog ea-php84-php-cli
* Tue Oct 20 2026 Cory McIntire <cory.mcintire@webpros.com> - 8.4.27-1
- EA-13608: Update ea-php84 from v8.4.26 to v8.4.27 (CVE-2026-109618, CVE-2026-109619)0 -
The updated versions don't appear to be showing on cloudlinux after running /scripts/upcp. Can you confirm they should be pushed there?
0 -
Correct with cloudlinux after updating:
root@xxx:~# rpm -qa | grep ea-php84
ea-php84-php-redis-6.1.0-1.el10.cloudlinux.x86_64
ea-php84-runtime-8.4.26-1.el10.cloudlinux.x86_64
ea-php84-8.4.26-1.el10.cloudlinux.x86_64
0 -
@cPRex, can you confirm if servers running Imunify360 and/or PHP Hardened were included, as my security update returned the following?
=> Log opened from cPanel Update (upcp) - Slave (30908) at Wed Oct 21 16:11:01 2026
[2026-10-21 16:11:01 +0200] Detected cron=1 (default)
[2026-10-21 16:11:01 +0200] An expedited package update is available. Updating packages from EA4.
[2026-10-21 16:11:03 +0200] Loaded plugins: fastestmirror, universal-hooks
[2026-10-21 16:11:03 +0200] Determining fastest mirrors
[2026-10-21 16:11:04 +0200] * EA4: 184.94.200.2
[2026-10-21 16:11:04 +0200] No packages marked for update
[2026-10-21 16:11:04 +0200]
[2026-10-21 16:11:04 +0200] Expedited package update completed
[2026-10-21 16:11:04 +0200] A log of this update is available at /var/cpanel/updatelogs/update.30908.3418072.1792557680.log
[2026-10-21 16:11:04 +0200] 100% complete
=> Log closed Wed Oct 21 16:11:04 20260 -
So what happens with those of us stuck with legacy systems (eg. PHP 7.0) and are using EasyApache for our PHP builds? We don't have the time or resources to upgrade code to PHP 8.x.
php.net has instructions for some .ini tweaks, but they don't mitigate the root cause.
0 -
Same here, i'm also stuck at 67%
0
Please sign in to leave a comment.
Comments
82 comments