Zurück zu den Sicherheitshinweisen

EasyApache 4 25.89 — cPanel & WHM Update

EasyApache 4 release 25.89 (October 7, 2026) is a security update across several packages: ea-apache24-mod_security2 updates to 2.9.15 fixing five vulnerabilities (CVE-2026-61812, CVE-2026-61813, CVE-2026-73857, CVE-2026-104259, CVE-2026-104269), ea-openssl11 patches five more (CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782), ea-ruby27-rubygem-nokogiri updates to 1.15.7 fixing CVE-2022-24836 and CVE-2022-29181, and Phusion Passenger 6.2.0 fixes two Watchdog vulnerabilities. Update the EasyApache 4 packages to pick up all of it.

High 6.3 CVSS
cPanel

Betroffene Versionen

25.89

Was das unter einer SharedLicense-Lizenz bedeutet

The fixes span the ModSecurity WAF engine, OpenSSL, the nokogiri XML library and Passenger — the request-filtering and crypto layers in front of every hosted site — leaving those layers' known flaws open until the packages are updated.

EasyApache 4 25.89

2026 October 7

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release updates ea-apache24-mod_security2 to 2.9.15. This version fixes five vulnerabilities (CVE-2026-61812, CVE-2026-61813, CVE-2026-73857, CVE-2026-104259 and CVE-2026-104269).

The release also patches ea-openssl11 for five vulnerabilities (CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, CVE-2026-77696 and CVE-2026-84782). It updates ea-ruby27-rubygem-nokogiri to 1.15.7, which fixes two vulnerabilities (CVE-2022-24836 and CVE-2022-29181).

Phusion Passenger 6.2.0 fixes two Watchdog vulnerabilities.

For a full list of changes, read the EasyApache 4 change log.

Häufig gestellte Fragen

What does EasyApache 4 25.89 fix?
Five mod_security2 vulnerabilities (CVE-2026-61812, CVE-2026-61813, CVE-2026-73857, CVE-2026-104259, CVE-2026-104269) via ModSecurity 2.9.15, five ea-openssl11 vulnerabilities (CVE-2026-35189, CVE-2026-54872, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782), two nokogiri vulnerabilities (CVE-2022-24836, CVE-2022-29181) via ea-ruby27-rubygem-nokogiri 1.15.7, and two Phusion Passenger Watchdog vulnerabilities fixed in Passenger 6.2.0.
Why does this release list CVEs from 2022?
CVE-2022-24836 and CVE-2022-29181 are older nokogiri vulnerabilities that the bundled ea-ruby27-rubygem-nokogiri package had not yet picked up; the 1.15.7 update closes them now. Old-year CVEs in a current release note mean backported fixes, not new bugs.
How do I apply the fix?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update, then confirm the packages show the 25.89-era versions (ModSecurity 2.9.15, nokogiri 1.15.7, Passenger 6.2.0). Apache restarts as part of the package update.
Which component matters most in 25.89?
ModSecurity and OpenSSL sit directly in the request path of every site — the WAF that filters attacks and the TLS library that secures connections. The aggregate severity is moderate, but those two packages make this update worth applying in the next maintenance window rather than deferring.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

ConfigServer Security & Firewall (CSF) 16.35-1 — cPanel & WHM Update

2026-11-09

ConfigServer Security & Firewall (CSF) 16.34-1 — cPanel & WHM Update

2026-11-02

PHP Security Release – CVE-2026-115560

2026-10-24

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen