EasyApache4 v25.94 Maintenance and Security Release

WebPros has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-php74
• EA-13630: Backport fix for CVE-2026-91765 and CVE-2025-14181
• (CVE-2026-91765) High: Unbounded recursion in SOAP XML parsing and decoding.
• (CVE-2025-14181) Moderate: Integer overflow in SOAP HTTP chunked response parsing.
• EA-13619: Report PHP version 7.4.34 to mark the CVE-2026-109618 and CVE-2026-109619 fixes. 

• ea-php74-meta
• EA-13619: Update to 7.4.34 to match ea-php74.

• ea-php80
• EA-13631: Backport fix for CVE-2026-91765 and CVE-2025-14181
• (CVE-2026-91765) High: Unbounded recursion in SOAP XML parsing and decoding.
• (CVE-2025-14181) Moderate: Integer overflow in SOAP HTTP chunked response parsing.
• EA-13619: Report PHP version 8.0.31 to mark the CVE-2026-109618 and CVE-2026-109619 fixes.

• ea-php80-meta
• EA-13619: Update to 8.0.31 to match ea-php80.

• ea-php81
• EA-13632: Backport fix for CVE-2026-91765 and CVE-2025-14181
• (CVE-2026-91765) High: Unbounded recursion in SOAP XML parsing and decoding.
• (CVE-2025-14181) Moderate: Integer overflow in SOAP HTTP chunked response parsing.
• EA-13619: Report PHP version 8.1.35 to mark the CVE-2026-109618 and CVE-2026-109619 fixes. 

• ea-php81-meta
• EA-13619: Update to 8.1.35 to match ea-php81.

• ea-podman
• EA4-360: Die early when user namespaces are unavailable; recommend cgroup v2 (except on CloudLinux 8)

• ea-ruby27-rubygem-rack
• EA-13629: Update ea-ruby27-rubygem-rack from v2.2.24 to v2.2.25
• (GHSA-5v64-555j-wjxm) Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
• (GHSA-wvg4-6p58-3gh3) Rack::Static header rules were matched against an unnormalized path, allowing dot segments to bypass them.
• (GHSA-p8x9-v4hv-2w4g) Multipart requests with more than one boundary parameter were accepted when the first value was empty or began with a quote, semicolon, or comma.