EasyApache 4 25.70 — cPanel & WHM Update
EasyApache 4 25.70 is cPanel & WHM's packaging of security fixes: CVE-2026-14355 (a memory corruption issue in openssl_encrypt with AES-WRAP-PAD) and, for PHP 8.
Affected Versions
25.70
What this means under a SharedLicense license
These are shared-hosting stack components (); with a CVSS of 5.6 in the advisory's own data and CWE-122 classed flaws, unpatched servers stay exposed until WHM's EasyApache update is applied.
Security and maintenance updates We released updated packages for EasyApache 4. This security release updates PHP 8.2, 8.3, 8.4, and 8.5 to address CVE-2026-14355 (a memory corruption issue in openssl_encrypt with AES-WRAP-PAD) and, for PHP 8.3, CVE-2026-12184 (a TLS setup failure leading to remote DoS). It also upd…
EasyApache 4 25.70
2026 July 8
Security and maintenance updates
We released updated packages for EasyApache 4.
This security release updates PHP 8.2, 8.3, 8.4, and 8.5 to address CVE-2026-14355 (a memory corruption issue in openssl_encrypt with AES-WRAP-PAD) and, for PHP 8.3, CVE-2026-12184 (a TLS setup failure leading to remote DoS). It also updates ea-libcurl to backport 13 CVEs from the curl 8.21.0 security advisory.
For a full list of changes, read the EasyApache 4 change log.
Frequently Asked Questions
What does EasyApache 4 25.70 fix?
Which packages are involved?
How do I apply it?
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System