Upcoming Critical PHP Security Release
Php just announced a upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC
It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
How can we update the php versions on our servers? it's a general update or easyphp? Do we have to wait for cpanel patches?
-
The specific version numbers were posted earlier in the thread:
8.5.12, 8.4.27, 8.3.36, 8.2.35, along with the backported versions 8.1.34,8.0.30, and 7.4.33
so you are indeed on the latest version.
1 -
Whoops. I thought maybe it was the specific build number that changed (-19.26.1) rather than the minor version number. My mistake.
Thanks for the quick response! :)
0 -
I tried:
yum update
Then tried:
/scripts/upcp --force
Then Reset PHP-FPM service for Apache
Then ran:for x in 85:8.5.12 84:8.4.27 83:8.3.36 82:8.2.35 81:8.1.34 80:8.0.30 74:7.4.33; do p=${x%%:*}; v=${x#*:}; installed=$(rpm -q --qf '%{VERSION}\n' "ea-php${p}-runtime" 2>/dev/null); if [[ "$installed" == "$v" ]]; then echo "OK: ea-php${p}-runtime $v"; else echo "WARNING: ea-php${p}-runtime expected $v, installed ${installed:-MISSING}"; fi; done
And still I get this..WARNING: ea-php85-runtime expected 8.5.12, installed 8.5.11
WARNING: ea-php83-runtime expected 8.3.36, installed 8.3.35
Tryingdnf upgrade 'ea-php*'Just says it's all up to date.
Any ideas?0 -
Are there any OWASP modsecurity rule sets available to block public exploits?
0 -
JohnnyBgood - can you send me the output of this command?
rpm -qa 'ea-php*-php-cli' | sort
0 -
Kristof De Vlieger - CloudLinux's first update has some details on how they mitigated this with Imunify360. Scroll to the bottom of the page and check the first update here:
0 -
Sorry cPRex
The server I was trying to update is using Imunify360 (I didn't even realise), so I guess it's got to wait for their php fix - which will hopefully be automatic.
[root@server ~]# rpm -qa 'ea-php*-php-cli' | sort
ea-php83-php-cli-8.3.35-1.el8.cloudlinux.x86_64
ea-php85-php-cli-8.5.11-1.el8.cloudlinux.x86_64
This.../scripts/upcp --force
Worked perfect on our other server, and updated to latest versions🙏
0 -
JohnnyBgood - that's exactly correct - you just have to wait at this point. But you can go back to playing guitar while you do!
0 -
Will cPanel provide a security update for
cpanel-php84for the Rocky Linux 8 and 9 / cPanel & WHM version is 132.0.35?$ /usr/local/cpanel/3rdparty/bin/php -v PHP 8.4.21 (cli) (built: May 11 2026 00:00:00) (NTS) Copyright (c) The PHP Group Zend Engine v4.4.21, Copyright (c) Zend Technologies
I've already done
/usr/local/cpanel/scripts/upcp
0 -
KaieR - have you tried a "yum update" on that machine? That also isn't the command I'd be using to check things.
You want to make sure the cpanel-php84 package is updated, as well as the EA packages mentioned earlier in this thread.
0 -
ea packages are updated, but having trouble with cpanel-php84 package update.
I haven't tried yum update because its seems like there's no update at the moment anyways:# rpm -q cpanel-php84 cpanel-php84-8.4.21-1.cp130~el9.x86_64 # dnf check-update cpanel-php84 Last metadata expiration check: 0:36:00 ago on Wed 21 Oct 2026 09:52:43 PM EEST. Security: kernel-core-5.14.0-687.36.1.el9_8.x86_64 is an installed security update Security: kernel-core-5.14.0-611.49.1.el9_7.x86_64 is the currently running version
# dnf list --showduplicates cpanel-php84 Last metadata expiration check: 0:38:24 ago on Wed 21 Oct 2026 09:52:43 PM EEST. Installed Packages cpanel-php84.x86_64 8.4.21-1.cp130~el9
0 -
Cloudlinux still without new packages... :)
session.upload_progress.enabled=0
I have applied this mitigation globally across all nodes, and I can see that CageFS has accepted them. I hope this will significantly limit the attack vector...0 -
It is always the same:
cPanel ea-php is released (for systems without CloudLinux)
alt-php is released for CloudLinux
but ea-php rebuild in CloudLinux is on the far end ...0 -
They have just released the updates.
dnf update "ea*" --enablerepo=imunify360-ea-php-hardened --refresh
0 -
I can confirm I have also just received the ea- package updates.
But why have they numbered them like 8.4.26-2 instead of 8.4.27?
# rpm -qa 'ea-php*-php-cli' | sort
ea-php81-php-cli-8.1.34-4.el8.cloudlinux.1.x86_64
ea-php82-php-cli-8.2.34-2.el8.cloudlinux.1.x86_64
ea-php84-php-cli-8.4.26-2.el8.cloudlinux.1.x86_640 -
We have some account using ea-php and some using alt-php in the same cloudlinux 8 server. I also confuse how to update it. Just wait /script/upcp to work?
0 -
Same boat, mixture of CL servers, and Hardened php, not sure what versions we should be on now.
0 -
Some productive feedback for Cloudlinux, as I think their roll out strategy needs improvement.
Why did Cloudlinux not update ea* first given its probably the most widely used? It makes sense to patch the most widely used versions and then move backwards with the alt versions.
And why are the patched version numbers not the same as cPanel patched versions i.e. 8.4.27? It makes it hard to know if the actual patch applied fixed things because the release numbers don't match.
Does anyone have guidance on the Cloudlinux patched versions?
for x in 85:8.5.12 84:8.4.27 83:8.3.36 82:8.2.35 81:8.1.34 80:8.0.30 74:7.4.33; do p=${x%%:*}; v=${x#*:}; installed=$(rpm -q --qf '%{VERSION}\n' "ea-php${p}-runtime" 2>/dev/null); if [[ "$installed" == "$v" ]]; then echo "OK: ea-php${p}-runtime $v"; else echo "WARNING: ea-php${p}-runtime expected $v, installed ${installed:-MISSING}"; fi; done
WARNING: ea-php85-runtime expected 8.5.12, installed 8.5.11
WARNING: ea-php84-runtime expected 8.4.27, installed 8.4.26
WARNING: ea-php83-runtime expected 8.3.36, installed 8.3.35
WARNING: ea-php82-runtime expected 8.2.35, installed package ea-php82-runtime is not installed
WARNING: ea-php81-runtime expected 8.1.34, installed package ea-php81-runtime is not installed
WARNING: ea-php80-runtime expected 8.0.30, installed package ea-php80-runtime is not installed
WARNING: ea-php74-runtime expected 7.4.33, installed package ea-php74-runtime is not installed
0 -
Cloud Linux update:
Fixed packages for the versions below are already available in our stable repositories. If you run any of them, please update now (a regular package update, e.g. `yum update alt-php*` / `apt upgrade`). Security advisory metadata (OVAL/VEX/UpdateInfo) will follow — until it is published, security-only update filters (`yum --security`, `dnf updateinfo`) will not list these packages.
ALT-PHP — fixed versions available now
• CloudLinux / AlmaLinux 8, 9: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux / AlmaLinux 10: 5.6, 7.4, 8.4
• CloudLinux 7: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux 6: 5.2, 5.6, 7.4, 8.0
• Ubuntu 18.04, 20.04, 22.04, 24.04: 5.2, 5.6, 7.4, 8.4
• Ubuntu 26.04: 5.6, 7.4, 8.4 · Ubuntu 16.04: 5.6, 7.4
• Debian 10, 11: 5.6, 7.4, 8.0, 8.4
• Debian 12: 5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Debian 13: 5.2–5.6, 7.4, 8.0, 8.1, 8.3, 8.4
• Alpine 3.23, 3.24: 7.3, 8.0, 8.1
Remaining alt-php versions are rolling out continuously; the bulk is expected by ~21:15 UTC, alt-php 8.5 by ~22:30 UTC.
TuxCare ELS / ESU — distribution PHP fixed and available now
RHEL 7, Oracle Linux 6 and 7, CentOS 8.4, CentOS 8.5, CentOS Stream 8, Amazon Linux 2, AlmaLinux 9.2 ESU, AlmaLinux 9.8 ESU, TuxCare 9.6 ESU, TuxCare 9.8 ESU, Ubuntu 16.04 / 18.04 / 20.04 ELS, Alpine 3.18 ELS
Releasing now: CloudLinux 7, Debian 11 ELS
Next: CentOS 6, CentOS 7, Debian 10 ELS, PHP for Windows
Interim protection: Imunify360 ModSecurity ruleset 8.84 (stable) blocks the known exploit pattern; servers with Imunify360 WAF enabled receive it automatically.0 -
That's indeed patched packages, no idea about their versioning system.
[root@srv03 ~]# rpm -q ea-php84-php-common
ea-php84-php-common-8.4.26-2.el9.cloudlinux.1.x86_64
[root@srv03 ~]# rpm -q --changelog ea-php84-php-common | head -6
* Wed Oct 21 2026 Nikolai Mardanov <nmardanov@cloudlinux.com> - 1:8.4.26-2.cloudlinux.1
- EA4D-1101: CVE-2026-109618, CVE-2026-109619: do not bail out from inside the
memory manager (allocation failures are reported through a deferred error
instead of unwinding through half-updated engine state) and clear stale
request globals at shutdown so a bailout cannot carry them into the next
request. Synced from alt-php84; upstream 506e87fa (PHP 8.4 branch)0 -
This was helpful to see if applied. Hope it helps someone else.
rpm -q --changelog ea-php84-php-fpm | grep -E 'CVE-2026-109618|CVE-2026-109619'- EA4D-1101: CVE-2026-109618, CVE-2026-109619: do not bail out from inside the...
This shows applied.
And:
rpm -qa --qf '%{NAME}\n' | grep -E '^ea-php[0-9]+-php-cli$' | sort | while read -r pkg; do echo "=== $(rpm -q "$pkg") ===" rpm -q --changelog "$pkg" | grep -E -m 5 'CVE-2026-109618|CVE-2026-109619' || echo "No matching CVE entry found — needs further verification" echo done0 -
It is really confused. I just run /scripts/upcp. It look all are updated from ea-php52 to ea-php84. But cloudlinux just said they will fix alt-php52 to alt-php84.
And version number is not sync. e.g. it should be 8.4.27 instead of 8.4.26. At this moment, I am still wondering if update success or not.
[root@XXXXXX ~]# for php in /opt/cpanel/ea-php*/root/usr/bin/php; do echo "$php: $($php -v | head -n 1)"; done
/opt/cpanel/ea-php51/root/usr/bin/php: PHP 5.1.6 (cli) (built: Jun 19 2026 09:14:26)
/opt/cpanel/ea-php52/root/usr/bin/php: PHP 5.2.17 (cli) (built: Oct 21 2026 14:47:16)
/opt/cpanel/ea-php53/root/usr/bin/php: PHP 5.3.29 (cli) (built: Oct 21 2026 15:07:51)
/opt/cpanel/ea-php54/root/usr/bin/php: PHP 5.4.45 (cli) (built: Oct 21 2026 15:38:13)
/opt/cpanel/ea-php55/root/usr/bin/php: PHP 5.5.38 (cli) (built: Oct 21 2026 15:57:28)
/opt/cpanel/ea-php56/root/usr/bin/php: PHP 5.6.40 (cli) (built: Oct 21 2026 15:06:48)
/opt/cpanel/ea-php70/root/usr/bin/php: PHP 7.0.33 (cli) (built: Oct 21 2026 16:22:04) ( NTS )
/opt/cpanel/ea-php71/root/usr/bin/php: PHP 7.1.33 (cli) (built: Oct 21 2026 16:35:31) ( NTS )
/opt/cpanel/ea-php72/root/usr/bin/php: PHP 7.2.34 (cli) (built: Oct 21 2026 16:51:54) ( NTS )
/opt/cpanel/ea-php73/root/usr/bin/php: PHP 7.3.33 (cli) (built: Oct 21 2026 18:08:12) ( NTS )
/opt/cpanel/ea-php74/root/usr/bin/php: PHP 7.4.33 (cli) (built: Oct 21 2026 14:39:45) ( NTS )
/opt/cpanel/ea-php80/root/usr/bin/php: PHP 8.0.30 (cli) (built: Oct 21 2026 15:10:28) ( NTS )
/opt/cpanel/ea-php81/root/usr/bin/php: PHP 8.1.34 (cli) (built: Oct 21 2026 15:57:29) (NTS)
/opt/cpanel/ea-php82/root/usr/bin/php: PHP 8.2.34 (cli) (built: Oct 21 2026 16:18:45) (NTS)
/opt/cpanel/ea-php83/root/usr/bin/php: PHP 8.3.35 (cli) (built: Oct 21 2026 16:42:26) (NTS)
/opt/cpanel/ea-php84/root/usr/bin/php: PHP 8.4.26 (cli) (built: Oct 21 2026 18:21:33) (NTS)
[root@XXXXXX ~]# rpm -q --changelog ea-php52-php-cli | grep -m1 CVE-2026-109618
- EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
[root@XXXXXX ~]# rpm -q --changelog ea-php81-php-cli | grep -m1 CVE-2026-109618
- EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
[root@XXXXXX ~]# rpm -q --changelog ea-php54-php-cli | grep -m1 CVE-2026-109618
- EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory
[root@XXXXXX ~]# rpm -q --changelog ea-php73-php-cli | grep -m1 CVE-2026-109618
- EA4D-1101: CVE-2026-109618, CVE-2026-109619: backport of upstream's PHP 7.4 EOL
[root@XXXXXX ~]# rpm -q --changelog ea-php84-php-cli | grep -m1 CVE-2026-109618
- EA4D-1101: CVE-2026-109618, CVE-2026-109619: do not bail out from inside the0 -
The way CloudLinux has been handling this is hysterical.
There is no way they weren't contacted by the PHP project prior to the official announcement.
It took them more than 6 hours to provide patches.
And the patched versions didn't bump the version number.0 -
I'm starting to rethink using CloudLinux, since I don't use ALT and only use EA-PHP. Was feeling very ignored.
0 -
So, I'm still not seeing any updates to any alt-phpXX packages, even though Cloudlinux states on their status page that:
ALT-PHP — fixed versions available now
• CloudLinux / AlmaLinux 8, 9: 5.2, 5.6, 7.4, 8.0, 8.4
• CloudLinux / AlmaLinux 10: 5.6, 7.4, 8.4Any ideas?
0 -
same - ive seen 0 altphp updates so far!
0
Please sign in to leave a comment.
Comments
86 comments