cPanel lists separate PHP fixes for its panel, EasyApache and CloudLinux

The panel and customer websites use separate PHP packages

cPanel and WHM give hosts and site owners tools for managing accounts, domains and server settings. Their internal PHP packages are distinct from EasyApache's PHP packages for websites, as cPanel's technical documentation explains.

The company's October 21 release notes describe a security update to internal PHP, including PHP used by Roundcube webmail. They identify cPanel & WHM releases 138.0.18, 136.0.50 and 134.0.66 with PHP 8.4.27, and release 110.0.153 with fixes adapted to PHP 8.1.34. The notes separately identify EasyApache 4 release 25.91 as fixing the two vulnerabilities in ea-php74 through ea-php85. Read cPanel's dated release notes.

The advisory lists panel builds with an extra 11. prefix, including 11.138.0.18, and WP Squared 11.138.1.17. These product numbers are separate from PHP package revisions.

EasyApache lists differ by package supplier

CloudLinux supplies a hosting operating system and PHP packages. Selected entries from the advisory's two EasyApache lists show the different revisions to check. These packages address the two vulnerabilities; their inclusion does not promise indefinite maintenance for an older PHP branch.

The full advisory includes older CloudLinux branches. Administrators need the supplier and complete installed revision.

At 14:31 UTC on October 22, CloudLinux explained that its ea-php and alt-php packages carry backports, fixes adapted to older PHP code. Its fixed PHP 8.4 example for CloudLinux OS 8 is 8.4.26-2.el8.cloudlinux.1. The status update documents the lower base number.

cPanel's release-notes page, last modified October 22, also describes EasyApache 4 release 25.92 rebuilding older PHP metapackages so their change logs list these backports. A metapackage groups related packages. That change concerns how the fix is recorded for ea-php74, ea-php80 and ea-php81; the preceding 25.91 entry records the security repair. Both entries carry October 21 release dates.

CloudLinux's native-PHP rollout reached stable on October 22

CloudLinux's 19:50 UTC update on October 22 says all affected native PHP builds have reached its stable release channel. Native PHP is supplied by the operating system, separately from ea-php and alt-php. This supersedes earlier partial-rollout notices. The status page records the change.

Its verification instructions distinguish newer native builds that use PHP's new version numbers from backported builds checked through their change logs. Some newer builds omit CVE identifiers from those logs, so searching only for an identifier can miss evidence of a fixed package.

CloudLinux's deployment instructions also call for restarting PHP services after updates.

Hosts still need to connect each domain to its maintained runtime

cPanel's MultiPHP Manager can show a domain's selected PHP version and whether PHP-FPM, a service that keeps PHP workers ready for requests, is enabled. Its documentation says individual domains can use different installed PHP versions. A domain can also inherit a version, meaning its selection follows another applicable setting. The MultiPHP documentation describes the domain list and who can change its options.

For a site owner with only a hosting-account login, that makes the host's answer important. Ask it to identify the package source and full revision serving the domain, confirm the applicable security notice, and state whether relevant services have restarted. A PHP version offered in a menu can help identify the branch, but the host may need server-level access to establish the full package and running service.

CloudLinux says alt-php and ea-php version numbers will move toward PHP's newer releases in later package updates.