Zurück zu den Sicherheitshinweisen

EasyApache 4 25.88 — cPanel & WHM Update

EasyApache 4 release 25.88 (October 2, 2026) updates ea-apache24 to Apache HTTP Server 2.4.69, fixing twenty vulnerabilities in one package refresh (CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768 and CVE-2026-93546). Individual severities are mostly low — the release's aggregate CVSS is 3.7 — but Apache serves every site on the server, so the update should go out with the next maintenance window.

High 3.7 CVSS
cPanel

Betroffene Versionen

25.88

Was das unter einer SharedLicense-Lizenz bedeutet

The twenty fixed flaws sit in the packaged Apache HTTP Server itself; among them is a handler type-confusion class issue (CWE-430). Unpatched, every hosted site on the server remains exposed to whatever request-handling bugs each CVE enables.

EasyApache 4 25.88

2026 October 2

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release updates ea-apache24 to Apache HTTP Server 2.4.69, which fixes twenty vulnerabilities (CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768 and CVE-2026-93546).

For a full list of changes, read the EasyApache 4 change log.

Häufig gestellte Fragen

What does EasyApache 4 25.88 fix?
Twenty Apache HTTP Server vulnerabilities (CVE-2026-42356, CVE-2026-42528, CVE-2026-46729, CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154, CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685, CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686, CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768 and CVE-2026-93546), all resolved by updating ea-apache24 to Apache 2.4.69. No other packages are mentioned in the release note.
Which EasyApache 4 versions are affected?
Package builds before 25.88 (October 2, 2026) that ship ea-apache24 below Apache 2.4.69. Release 25.88 is the marker release containing the fix; cPanel notes the previous EasyApache 4 25.86 PHP update separately, so servers should be current on both.
How do I apply the fix?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update, then confirm the ea-apache24 package reports Apache 2.4.69 or later. Apache picks the new version up after the package update; a graceful restart applies it to running workers.
Are these Apache flaws severe?
Individually mostly low — the release's aggregate CVSS is 3.7, and a handler type-confusion issue (CWE-430) is among the classes fixed. Volume is the point: twenty flaws closed in one update on the web server that fronts every hosted site, so take the package update promptly even though no single CVE is critical.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

ConfigServer Security & Firewall (CSF) 16.35-1 — cPanel & WHM Update

2026-11-09

ConfigServer Security & Firewall (CSF) 16.34-1 — cPanel & WHM Update

2026-11-02

PHP Security Release – CVE-2026-115560

2026-10-24

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen