Back to Security Advisories

EasyApache 4 25.88 — cPanel & WHM Update

EasyApache 4 release 25.88 (October 2, 2026) updates ea-apache24 to Apache HTTP Server 2.4.69, fixing twenty vulnerabilities in one package refresh (CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768 and CVE-2026-93546). Individual severities are mostly low — the release's aggregate CVSS is 3.7 — but Apache serves every site on the server, so the update should go out with the next maintenance window.

High 3.7 CVSS
cPanel

Affected Versions

25.88

What this means under a SharedLicense license

The twenty fixed flaws sit in the packaged Apache HTTP Server itself; among them is a handler type-confusion class issue (CWE-430). Unpatched, every hosted site on the server remains exposed to whatever request-handling bugs each CVE enables.

EasyApache 4 25.88

2026 October 2

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release updates ea-apache24 to Apache HTTP Server 2.4.69, which fixes twenty vulnerabilities (CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768 and CVE-2026-93546).

For a full list of changes, read the EasyApache 4 change log.

Frequently Asked Questions

What does EasyApache 4 25.88 fix?
Twenty Apache HTTP Server vulnerabilities (CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768 and CVE-2026-93546), all resolved by updating ea-apache24 to Apache 2.4.69. No other packages are mentioned in the release note.
Which EasyApache 4 versions are affected?
Package builds before 25.88 (October 2, 2026) that ship ea-apache24 below Apache 2.4.69. Release 25.88 is the marker release containing the fix; cPanel notes the previous EasyApache 4 25.86 PHP update separately, so servers should be current on both.
How do I apply the fix?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update, then confirm the ea-apache24 package reports Apache 2.4.69 or later. Apache picks the new version up after the package update; a graceful restart applies it to running workers.
Are these Apache flaws severe?
Individually mostly low — the release's aggregate CVSS is 3.7, and a handler type-confusion issue (CWE-430) is among the classes fixed. Volume is the point: twenty flaws closed in one update on the web server that fronts every hosted site, so take the package update promptly even though no single CVE is critical.

References

Security Advisories

Related Advisories

EasyApache 4 25.91 — cPanel & WHM Update

2026-10-21

EasyApache 4 25.92 — cPanel & WHM Update

2026-10-21

cPanel CVE-2026-110672

2026-10-19 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System