Upcoming Critical PHP Security Release
Php just announced a upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC
It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
How can we update the php versions on our servers? it's a general update or easyphp? Do we have to wait for cpanel patches?
-
The best solution would be to update the code base. PHP 7.0 has been end-of-life since January 2019. Can you at least update to 7.4?
0 -
One of our servers was also stuck on 67% for a while - but it was able to complete after some waiting (and I refreshed web ui).
However, after the 138.0.18 update, the WHM web ui is just hanging on "Loading profiles ..." in Home / Software / EasyApache 4 for several minutes now. Will edit this if it resolves itself.
Edit: It resolved itself. Probably the cPanel update servers having a hard time right now.
0 -
The best solution would be to update the code base. PHP 7.0 has been end-of-life since January 2019. Can you at least update to 7.4?
Unfortunately, not without some significant changes. This is one of those code bases that's held together with hopes and dreams.
0 -
IM getting same issue with Easy Apache.
0 -
I now also have 138.0.18, but how can i check if i have the patched php versions?
1 -
Cloudlinux repos failing again, come on.
0 -
To check the packages on the system you can run this:
rpm -qa 'ea-php*-php-cli' | sort
If those have the updated versions, you're all set.
0 -
I updated to 138.0.18 but php-v still shows the old version 8.5.11. Already restarted the service.
0 -
cPRex, what are these updates coming with --security for all packages (one given here as an example) for ea-php5x?
[2026-10-21 16:42:10 +0300] ---> Package ea-php56-php-cli.x86_64 0:5.6.40-25.27.31.cpanel will be updated
[2026-10-21 16:42:10 +0300] ---> Package ea-php56-php-cli.x86_64 0:5.6.40-25.27.32.cpanel will be an update0 -
gatewayza - CloudLinux hasn't even released the update either at this point.
0 -
Justin Mosterd - see the rpm command I posted for an accurate way to check the versions. Remember that these updates are staggered so you may not all get the update at the exact same time.
0 -
Well, that does not really matter in the big scheme of things, it failing already.
0 -
I'm also stuck at ""Loading profiles ..." in EasyApache4...
0 -
gvard - note that only the very last number of the package updated since we needed to make a new build to push. That version is valid, but doesn't receive any of the security updates that 7.4 and newer get.
0 -
Easy apache updated, but still have old versions.
0 -
Same here David.
0 -
What are the new version numbers?
I see this :
ea-php56-php-cli-5.6.40-25.el8.cloudlinux.17.x86_64
ea-php70-php-cli-7.0.33-29.el8.cloudlinux.16.x86_64
ea-php71-php-cli-7.1.33-20.el8.cloudlinux.16.x86_64
ea-php72-php-cli-7.2.34-12.el8.cloudlinux.17.x86_64
ea-php73-php-cli-7.3.33-15.el8.cloudlinux.17.x86_64
ea-php74-php-cli-7.4.33-18.el8.cloudlinux.12.x86_64
ea-php80-php-cli-8.0.30-11.el8.cloudlinux.x86_64
ea-php81-php-cli-8.1.34-3.el8.cloudlinux.9.x86_64
ea-php82-php-cli-8.2.34-1.el8.cloudlinux.x86_64
ea-php83-php-cli-8.3.35-1.el8.cloudlinux.x86_64
ea-php84-php-cli-8.4.26-1.el8.cloudlinux.x86_64
ea-php85-php-cli-8.5.11-1.el8.cloudlinux.x86_640 -
Eelco: 8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33
0 -
Those using Imunify360 and/or Cloudlinux will receive their fixes from Cloudlinux and they are only releasing later.
0 -
So for hosters on CloudLinux; in about 4 hours time, unless they are able to speed it up.
The releases for alt-php are already in progress. The ea-php is also proceeding to release soon
We plan to release fixes for alt-php and ea-php by 19:00 UTC. Maximum effort is currently being made to get this done sooner.Ref: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
0 -
There are some workarounds described here to reduce the risk of exposure, if you cannot update immediately.
https://www.php.net/archive/2026.php#2026-10-21-5(Also, I prefer using a direct ssh connection for updating. The webinterface crashed way too often on me to trust it anymore.)
0 -
To find out if you are running the newest versions (as of the time of this posting) you can run this command:
for x in 85:8.5.12 84:8.4.27 83:8.3.36 82:8.2.35 81:8.1.34 80:8.0.30 74:7.4.33; do p=${x%%:*}; v=${x#*:}; installed=$(rpm -q --qf '%{VERSION}\n' "ea-php${p}-runtime" 2>/dev/null); if [[ "$installed" == "$v" ]]; then echo "OK: ea-php${p}-runtime $v"; else echo "WARNING: ea-php${p}-runtime expected $v, installed ${installed:-MISSING}"; fi; doneIt will tell you if you have the newest version, if not, or if the version in question is not installed as everyone may not have 8.5, 8.4. 8.3, etc.
You will see an output like this:
WARNING: ea-php85-runtime expected 8.5.12, installed package ea-php85-runtime is not installed
WARNING: ea-php84-runtime expected 8.4.27, installed 8.4.26
WARNING: ea-php83-runtime expected 8.3.36, installed 8.3.35
WARNING: ea-php82-runtime expected 8.2.35, installed 8.2.34
OK: ea-php81-runtime 8.1.34
OK: ea-php80-runtime 8.0.30
OK: ea-php74-runtime 7.4.332 -
cPRex I have updated server to 138.0.18 and when check the PHP version its still:
For example:
ea-php84-php-curl-8.4.26-1
There is something to change more?0 -
You want to check the main versions with this command:
rpm -qa 'ea-php*-php-cli' | sort
and see if they match the expected updated versions I posted earlier.
0 -
Hello,
Ok, but you didnt tell that it works when you dont using Cloudlinux :)
Additionally, after the update, I had to run `yum update`, which is when it finally downloaded the new PHP packages.On your website, the changelog only mentions version 8.4:
138.0.18
2026-10-21
- Fixed CPANEL-57977: Update cpanel-php84 to 8.4.27. Fixes: CVE-2026-109618 and CVE-2026-109619.
0 -
That's the cPanel changelog, which is correct for the internal PHP used to handle the interfaces in cPanel & WHM. The change log for EasyApache would be listed here, and shows all the versions: https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/
0 -
First, THANK YOU guys for patching 7.4. Still have one site stuck on an old version of OSCommerce and was really worried I'd have to take it offline.
Second, I wanted to point out, as others have, that I also had to run dnf update after /scripts/upcp --security ran as it only updated the cPanel PHP packages, not the EasyApache packages.
1 -
Not work on Cloudlinux. I have almalinux and cloudlinux. After upcp, almalinux php updated. But not in cloudlinux
0 -
Wing Nam - CloudLinux hasn't released the update yet. I've linked this in a few places today, but you can follow along here to see how their update process is going: https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5
0 -
cPRex I guess I'm kind of forced to upgrade to, at the very least, php 7.4 now.
Running `rpm -qa | grep ea-php74` gives:
ea-php74-php-cli-7.4.33-19.26.1.cpanel.x86_64Is that the latest, patched version? I'm not seeing any version numbers on the changelog page at https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/
0
Please sign in to leave a comment.
Comments
86 comments