Back to Security Advisories

EasyApache 4 25.91 — cPanel & WHM Update

EasyApache 4 release 25.91 (October 21, 2026) is cPanel's delivery vehicle for the PHP2Shell emergency fixes: it patches the two critical, actively exploited PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619 — unauthenticated remote code execution) across every packaged PHP branch, ea-php74 through ea-php85, including the end-of-life branches via PHP's official source backports. It also fixes fourteen ea-libcurl vulnerabilities and updates nginx, njs, ModSecurity, libzip and Passenger. With aggregate CVSS 9.8 and public exploits circulating since before disclosure, install 25.91 now — patching is the only real protection.

Critical 9.8 CVSS
cPanel

Affected Versions

25.91

What this means under a SharedLicense license

The two critical PHP flaws sit in the engine itself and are exploited in the wild since October 17, 2026 — every unpatched EasyApache server hosting PHP is an active target, and fourteen curl flaws compound the exposure.

EasyApache 4 25.91

2026 October 21

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release fixes two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in ea-php74 through ea-php85. It also patches ea-libcurl for 14 vulnerabilities, including CVE-2026-92392 (high), updates ea-nginx to 1.31.7 (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205 and CVE-2026-97629), ea-nginx-njs to 1.0.2 (CVE-2026-101019 and CVE-2026-101025) and ea-modsec30 to 3.0.17.

The release also updates ea-libzip to 1.12.1 and Passenger to 6.2.1, and ea-podman keeps its cPanel hooks registered across upgrades and re-points web application proxies after a restore.

For a full list of changes, read the EasyApache 4 change log.

Frequently Asked Questions

Does EasyApache 4 25.91 fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
Yes — 25.91 is cPanel's fix for the actively exploited PHP2Shell flaws, backported across ea-php74 through ea-php85. Upstream, the fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; EasyApache carries the equivalent backports for legacy branches. Update to 25.91 or later and confirm your PHP version reflects the fix.
How severe is the 25.91 update?
Aggregate CVSS 9.8 (use-after-free class, CWE-416) on the two PHP flaws alone, with fourteen more ea-libcurl vulnerabilities including CVE-2026-92392 (high), four ea-nginx CVEs via nginx 1.31.7, two ea-nginx-njs CVEs via njs 1.0.2, plus ModSecurity 3.0.17, libzip 1.12.1 and Passenger 6.2.1.
Is PHP2Shell being exploited on cPanel servers?
Exploitation is confirmed in the wild generally: Amazon Threat Intelligence observed attempts from October 17, 2026 — before disclosure — and public exploits exist. cPanel servers are not exempt; unpatched PHP on any internet-facing server is targetable regardless of panel.
Is partial mitigation enough while I schedule the update?
No. PHP's suggested mitigations (non-overridable memory_limit=-1, session.upload_progress.enabled=0, worker restarts, memory caps) reduce exposure but vendors are explicit they do not make an installation safe. Install 25.91 — the package update takes minutes via WHM → EasyApache 4 → Update or yum update 'ea-*'.

References

Security Advisories

Related Advisories

EasyApache 4 25.92 — cPanel & WHM Update

2026-10-21

cPanel CVE-2026-110672

2026-10-19 00:00:00

cPanel CVE-2026-110673

2026-10-19 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System