EasyApache4 v25.91 Maintenance and Security Release

WebPros has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-php74
• EA-13613: Backport fix for CVE-2026-109618 and CVE-2026-109619

• ea-php80
• EA-13612: Backport fix for CVE-2026-109618 and CVE-2026-109619

• ea-php81
• EA-13611: Backport fix for CVE-2026-109618 and CVE-2026-109619

• ea-php82
• EA-13610: Update ea-php82 from v8.2.34 to v8.2.35 (CVE-2026-109618, CVE-2026-109619)

• ea-php83
• EA-13609: Update ea-php83 from v8.3.35 to v8.3.36 (CVE-2026-109618, CVE-2026-109619)

• ea-php84
• EA-13608: Update ea-php84 from v8.4.26 to v8.4.27 (CVE-2026-109618, CVE-2026-109619)

• ea-php85
• EA-13607: Update ea-php85 from v8.5.11 to v8.5.12 (CVE-2026-109618, CVE-2026-109619)

• ea-libcurl
• EA-13595: Backport curl 8.23.0 security fixes to 8.17.0
• (CVE-2026-92392) high: HTTP/2 upload use-after-free
• (CVE-2026-107929) low: Local interface connection reuse mixup
• (CVE-2026-94266) low: Password leak in CURLINFO_EFFECTIVE_URL
• (CVE-2026-92391) low: curl_mime_free stack overflow by recursion
• (CVE-2026-92390) low: -J no-clobber guarantee bypassed with 103 early hints
• (CVE-2026-92389) low: TFTP direction confusion
• (CVE-2026-92388) low: FTP wildcard write callback mixup
• (CVE-2026-92387) low: Never-ending loop via server response omission
• (CVE-2026-92386) low: Server-set cookie aborts cookie jar load
• (CVE-2026-87865) low: knownhost callback mismatches key as missing
• (CVE-2026-87863) low: HSTS response erases persisted entries
• (CVE-2026-87862) low: HSTS cache import drops longer-lived child
• (CVE-2026-86414) low: Leaking host credentials to HTTP proxy
• (CVE-2026-86410) low: Redirect to SFTP or SCP bypasses host verification

• ea-nginx
• EA-13600: Update ea-nginx from v1.31.6 to v1.31.7 (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205, CVE-2026-97629)

• ea-nginx-njs
• EA-13599: Update ea-nginx-njs from v1.0.1 to v1.0.2
• (CVE-2026-101025) Memory exhaustion when repeatedly parsing malformed XML
• (CVE-2026-101019) Inconsistent XML attribute values with entity references, affecting signed XML validation

• ea-nginx-echo
• EA-13600: Build against ea-nginx version v1.31.7

• ea-nginx-headers-more
• EA-13600: Build against ea-nginx version v1.31.7

• ea-modsec30-connector-nginx
• EA-13600: Build against ea-nginx version v1.31.7

• ea-modsec30
• EA-13581: Update ea-modsec30 from v3.0.16 to v3.0.17 (CVE-2026-61812, CVE-2026-61813, CVE-2026-73856, CVE-2026-73857, CVE-2026-103932, CVE-2026-104259, CVE-2026-104269, GHSA-4j47-8qcr-jf59)

• ea-libzip
• EA-13597: Update ea-libzip from v1.12 to v1.12.1

• ea-passenger-src
• EA-13602: Update ea-passenger-src from v6.2.0 to v6.2.1
• EA-13596: Stop shipping patch backup files in the Passenger source tree

• ea-apache24-mod-passenger
• EA-13602: ea-passenger-src was updated from v6.2.0 to v6.2.1
• EA-13596: Rebuild against ea-passenger-src so patch backup files are no longer shipped

• ea-nginx-passenger
• EA-13602: ea-passenger-src was updated from v6.2.0 to v6.2.1
• EA-13600: Build against ea-nginx version v1.31.7

• ea-ruby27-passenger
• EA-13602: ea-passenger-src was updated from v6.2.0 to v6.2.1
• EA-13596: Build from ea-passenger-src instead of a separate Passenger source tarball

• ea-podman
• EA4-339: Keep the PodmanHooks cPanel hooks registered across RPM upgrades, reinstalls and downgrades
• EA4-344: Catch port assignment failures
• EA4-338, CPANEL-55949: Re-point web application proxies at the end of a user-run restore, so an account whose container ports were reassigned comes back serving instead of returning 503