Back to Security Advisories

EasyApache 4 25.89 — cPanel & WHM Update

EasyApache 4 release 25.89 (October 7, 2026) is a security update across several packages: ea-apache24-mod_security2 updates to 2.9.15 fixing five vulnerabilities (CVE-2026-61812, CVE-2026-61813, CVE-2026-73857, CVE-2026-104259, CVE-2026-104269), ea-openssl11 patches five more (CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782), ea-ruby27-rubygem-nokogiri updates to 1.15.7 fixing CVE-2022-24836 and CVE-2022-29181, and Phusion Passenger 6.2.0 fixes two Watchdog vulnerabilities. Update the EasyApache 4 packages to pick up all of it.

High
cPanel

Affected Versions

25.89

What this means under a SharedLicense license

The fixes span the ModSecurity WAF engine, OpenSSL, the nokogiri XML library and Passenger — the request-filtering and crypto layers in front of every hosted site — leaving those layers' known flaws open until the packages are updated.

EasyApache 4 25.89

2026 October 7

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release updates ea-apache24-mod_security2 to 2.9.15. This version fixes five vulnerabilities (CVE-2026-61812, CVE-2026-61813, CVE-2026-73857, CVE-2026-104259 and CVE-2026-104269).

The release also patches ea-openssl11 for five vulnerabilities (CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, CVE-2026-77696 and CVE-2026-84782). It updates ea-ruby27-rubygem-nokogiri to 1.15.7, which fixes two vulnerabilities (CVE-2022-24836 and CVE-2022-29181).

Phusion Passenger 6.2.0 fixes two Watchdog vulnerabilities.

For a full list of changes, read the EasyApache 4 change log.

Frequently Asked Questions

What does EasyApache 4 25.89 fix?
Five mod_security2 vulnerabilities (CVE-2026-61812, CVE-2026-61813, CVE-2026-73857, CVE-2026-104259, CVE-2026-104269) via ModSecurity 2.9.15, five ea-openssl11 vulnerabilities (CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782), two nokogiri vulnerabilities (CVE-2022-24836, CVE-2022-29181) via ea-ruby27-rubygem-nokogiri 1.15.7, and two Phusion Passenger Watchdog vulnerabilities fixed in Passenger 6.2.0.
Why does this release list CVEs from 2022?
CVE-2022-24836 and CVE-2022-29181 are older nokogiri vulnerabilities that the bundled ea-ruby27-rubygem-nokogiri package had not yet picked up; the 1.15.7 update closes them now. Old-year CVEs in a current release note mean backported fixes, not new bugs.
How do I apply the fix?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update, then confirm the packages show the 25.89-era versions (ModSecurity 2.9.15, nokogiri 1.15.7, Passenger 6.2.0). Apache restarts as part of the package update.
Which component matters most in 25.89?
ModSecurity and OpenSSL sit directly in the request path of every site — the WAF that filters attacks and the TLS library that secures connections. The aggregate severity is moderate, but those two packages make this update worth applying in the next maintenance window rather than deferring.

References

Security Advisories

Related Advisories

EasyApache 4 25.91 — cPanel & WHM Update

2026-10-21

EasyApache 4 25.92 — cPanel & WHM Update

2026-10-21

cPanel CVE-2026-110672

2026-10-19 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System