Patch cPanel PHP RCE Flaws: Check EasyApache Today

If you run your own cPanel server, check two things today: your cPanel and WHM build number, and the PHP versions that EasyApache 4 has installed. Many servers patch cPanel itself automatically, because security updates apply every hour by default, but "many" is not "yours", and both checks take less than ten minutes.

Here is the part many people miss. On 21 October 2026 cPanel shipped a security update for its own internal PHP, the copy that runs cPanel interfaces "including Roundcube webmail", to fix two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Remote code execution (RCE) means an attacker could make your server run code they choose. Then on 4 November 2026, EasyApache 4 release 25.94 fixed two more CVEs in the SOAP extension of PHP 7.4, 8.0 and 8.1, and bumped those packages to version numbers that do not exist upstream.

By the end of this guide you will know which build numbers mean "patched", how to update from WHM or the command line, and how to prove it worked.

What these cPanel PHP fixes actually are

A cPanel server has two separate sets of PHP. The first is cPanel's internal PHP, which cPanel's own documentation calls "cPanel & WHM's internal PHP packages". It powers cPanel itself, and its php.ini file "is not the EasyApache 4 php.ini file". The second is the PHP that runs your websites, installed by EasyApache 4 as packages named ea-php74, ea-php81, ea-php84 and so on.

Think of it like a restaurant. The internal PHP is the kitchen staff's own toolkit, and the EasyApache PHP is what gets served to customers. A safety recall on the staff tools does not fix the customer plates, and the reverse is also true. You need to check both.

Why this matters: your websites can be on PHP 8.4 with every update applied, and the webmail login page could still be running on an older internal PHP. They update through different paths.

The 21 October fixes, in plain numbers

The cPanel release notes for 21 October 2026 list the fixed cPanel and WHM builds for the internal PHP:

• Version 138.0.18 includes PHP 8.4.27
• Version 136.0.50 includes PHP 8.4.27
• Version 134.0.66 includes PHP 8.4.27
• Version 110.0.153 "includes backported security fixes for PHP 8.1.34"

The same day, EasyApache 4 release 25.91 fixed "two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)" in ea-php74 through ea-php85. For the newer branches, the EasyApache 4 change log shows normal version updates:

• ea-php82 from 8.2.34 to 8.2.35
• ea-php83 from 8.3.35 to 8.3.36
• ea-php84 from 8.4.26 to 8.4.27
• ea-php85 from 8.5.11 to 8.5.12

For ea-php74, ea-php80 and ea-php81, cPanel backported the fix instead. A backport means cPanel copied the security fix into an old version that the PHP project no longer updates. Release 25.91 also patched ea-libcurl for 14 vulnerabilities and updated ea-nginx to 1.31.7, ea-nginx-njs to 1.0.2 and ea-modsec30 to 3.0.17.

The 4 November fix most people skipped

EasyApache 4 release 25.94, dated 4 November 2026, backported fixes for CVE-2026-91765 and CVE-2025-14181 into ea-php74, ea-php80 and ea-php81. The change log rates them high and moderate, and both sit in the SOAP extension. SOAP is an older way for programs to exchange XML messages.

In the same release, those three packages started reporting PHP 7.4.34, 8.0.31 and 8.1.35 "to mark the CVE-2026-109618 and CVE-2026-109619 fixes". The change log says plainly that no upstream 7.4.34, 8.0.31 or 8.1.35 release exists. So if you see PHP 8.1.35 on your server and cannot find it on php.net, that is expected. It is cPanel's label, not a typo.

Release 25.94 lists no changes for ea-php82 to ea-php85. If all your sites are on PHP 8.2 or newer, the 4 November SOAP fix does not apply to those packages.

Heads up: PHP 7.4, 8.0 and 8.1 no longer get upstream security support, which is exactly why cPanel has to backport. If you are still on one of them, plan a move. Our PHP 8.2 security support guide walks through how to upgrade without breaking a site.

Before you start

This guide is for people with root access to WHM: VPS owners, dedicated server owners, and reseller customers whose host gives them root. If you are on shared hosting, you cannot run these updates yourself. Skip to the end and send your host the ready-made message.

• Root login to WHM, or SSH access as root
• About 10 minutes to check, and 15 to 45 minutes if an update has to run
• A recent backup or a provider snapshot (see Step 1)
• A quiet time window, in case an update needs a restart or a site needs a quick fix afterwards
• Risk level: low for security updates inside your current major version, but never zero

Quick tip: open a second SSH session before you start. If one session drops during an update, you still have a way in.

How to patch cPanel and EasyApache 4 PHP

The cPanel release notes list the fixed builds but do not give step-by-step remediation. The steps below come from cPanel's general update documentation, so they are the normal update process, not a special CVE procedure.

Step 1: Take a backup you can restore

Updates rarely break things, but "rarely" is the word that ruins weekends. First, check that your scheduled backups are on and recent in WHM > Backup > Backup Configuration, which cPanel describes as the interface that "allows system administrators to customize their scheduled backups".

If your server is a cloud VPS, also take a snapshot from your provider's control panel. A snapshot is a copy of the whole disk at one moment, so you can roll back the entire server in minutes. If you are not sure your plan includes snapshots, ask your host.

Step 2: Check your cPanel and WHM version

WHM shows the version in the top right corner of the interface. You can also check it from SSH.

This command prints the installed cPanel and WHM version:

/usr/local/cpanel/cpanel -V

Compare the major number and build it shows with the list above. On major 138 you want build 18 or later, on 136 build 50 or later, on 134 build 66 or later, and on 110 build 153 or later.

If your server is on a different major version that is not in that list, the 21 October release notes do not name a fixed build for it. Check the cPanel release notes for your version, or ask your host or cPanel support.

Step 3: Check that automatic security updates are on

Go to WHM > Home > Server Configuration > Update Preferences. Look for the checkbox "Automatically apply security updates as soon as they are available".

When it is ticked, which is the default, a cron job checks for security updates for your current major version every hour and applies them. cPanel's docs say this cron job runs even if you set version or package updates to manual. cPanel recommends keeping it ticked.

If it is unticked, that is probably why your server is behind. Tick it and save, unless you have a written reason to keep it off.

Step 4: Update cPanel and WHM

Go to WHM > Home > cPanel > Upgrade to Latest Version and click Click to Upgrade. This runs /usr/local/cpanel/scripts/upcp, cPanel's main update script, which also calls rpmup2 and sysup to update system packages and required OS dependencies.

If you prefer SSH, this command runs the same update script as root:

/usr/local/cpanel/scripts/upcp

The output scrolls for a while. When it finishes, run /usr/local/cpanel/cpanel -V again and confirm the build number moved. If the upgrade hits a blocker, cPanel says it "will stop and send a warning message". Read that message before you try again.

Why this matters: the release notes tie the internal PHP fix to cPanel and WHM builds, so getting onto a fixed build is what patches the PHP behind cPanel interfaces and Roundcube.

Step 5: Update the EasyApache 4 packages

Go to WHM > Home > Software > EasyApache 4 and click Run system update. This sends you to WHM > Home > Software > System Update, where you can update the system packages, including the ea- packages.

cPanel's own update guide says: "We strongly recommend that you run EasyApache when a new Apache build becomes available." Treat a security release like 25.94 the same way.

If you installed PHP extensions by hand, outside EasyApache, cPanel's docs say you "must manually update" them. Those do not update with the rest.

Step 6: List what is installed

Back in WHM > Home > Software > EasyApache 4, find the Currently Installed Packages section and click View all packages. Real package names start with ea-, for example ea-php81, even though the interface may show friendlier labels.

Write down every ea-php version you see. You will use that list in the next section.

Made-up example: Priya runs a small VPS with six client sites. Five are on PHP 8.3, and one old WooCommerce shop is stuck on PHP 8.1 because of a shipping plugin that uses SOAP. Her cPanel build updated itself on 21 October, so she assumed she was done. When she checks the list, the PHP 8.1 package is the one that still needs the 4 November release. That one old site is the reason to look.

How to check it worked

Do not trust "the update ran". Trust the version numbers you can see.

Check the cPanel build

This command shows the cPanel and WHM version after the update:

/usr/local/cpanel/cpanel -V

Expected result: major 138 at build 18 or later, 136 at build 50 or later, 134 at build 66 or later, or 110 at build 153 or later.

Check each EasyApache PHP version

EasyApache 4 puts a command-line symlink for each installed PHP at /usr/local/bin/ea-php##, where ## is the two-digit version. The PHP -v option prints the version number.

This loop prints the version of every EasyApache PHP installed on the server:

for p in /usr/local/bin/ea-php[0-9][0-9]; do echo "== $p"; "$p" -v | head -n 1; done

Compare each first line with the patched versions:

• ea-php74: 7.4.34
• ea-php80: 8.0.31
• ea-php81: 8.1.35
• ea-php82: 8.2.35 or later
• ea-php83: 8.3.36 or later
• ea-php84: 8.4.27 or later
• ea-php85: 8.5.12 or later

If PHP 7.4, 8.0 or 8.1 shows an older number, the 4 November release has not reached your server yet. Go back to Step 5.

Check whether SOAP is loaded

The PHP -m option lists the loaded modules. This shows whether SOAP is loaded for PHP 8.1, and you can swap 81 for 74 or 80:

/usr/local/bin/ea-php81 -m | grep -i soap

If it prints soap, the extension is loaded and the 4 November fix matters for that version. If it prints nothing, SOAP is not loaded for that PHP, but you should still update so you are covered if someone turns it on later.

Check in the browser

Log in to Roundcube webmail for one test account and send yourself an email. Then open one site on each PHP version you use and click through a page that uses a database, such as a login or a search. If all of that works, the update did not break anything visible.

Troubleshooting

The build number did not change after "Click to Upgrade"

Symptom: /usr/local/cpanel/cpanel -V shows the same build as before. The likely cause is that the upgrade stopped on a blocker, which cPanel says will stop the process and send a warning. Read the warning in WHM or in the upcp output, fix what it names, and run /usr/local/cpanel/scripts/upcp again. If it still fails, cPanel's docs say to submit a ticket to cPanel Technical Support.

The Upgrade to Latest Version page is missing

Symptom: you log in as a reseller and cannot find the interface. cPanel's docs say your hosting provider may disable this interface for resellers. That is not a fault. Ask your host to confirm the server's build number for you.

Automatic updates are off and you are not sure why

Symptom: the Update Preferences page shows manual updates, or the upgrade page offers "Enable automatic updates". Someone may have turned them off to avoid surprise changes. Ask your team first. If nobody has a reason, turn the security update checkbox back on, because it only applies security fixes for the version you already run.

PHP 8.1 still shows an old version after System Update

Symptom: /usr/local/bin/ea-php81 -v does not show 8.1.35. A common cause is a mirror or repository that has not caught up, or a third-party repository getting in the way. cPanel's docs warn that "Third-party repositories can cause problems with cPanel & WHM and updates from the OS repository." Wait an hour, run System Update again, and review any repositories you added yourself.

You cannot find 8.1.35 or 7.4.34 on php.net

Symptom: you search for the version and find nothing. This is expected. The EasyApache 4 change log says no upstream 7.4.34, 8.0.31 or 8.1.35 release exists. These numbers mark cPanel's backported fixes.

A site broke right after the update

Symptom: a white page or a 500 error on one site. Check that site's error log first, because the cause is often a hand-installed PHP extension that did not update with the rest. cPanel's docs say those must be updated manually. If you cannot fix it quickly, restore from the backup or snapshot from Step 1 and investigate on a copy.

The update ran but a service did not restart

Symptom: sites still behave oddly, or a version check looks right but the web pages act old. Reboot during your quiet window so every service starts fresh on the new packages. If the update included kernel packages, cPanel's docs say you must reboot the server after a kernel update anyway.

Pro tips and when to ask for help

Quick tip: while you are in WHM, look at your TLS settings too. Our guide to checking TLS 1.3 on Apache, Nginx and WHM fits nicely into the same maintenance window.

If your server also runs Ubuntu, remember that cPanel updates do not replace normal OS patching. Our walkthrough on patching an APT vulnerability on an Ubuntu VPS covers that side.

Heads up: on 28 October 2026, between these two releases, EasyApache 4 release 25.93 updated ea-nginx to 1.31.8 and ea-brotli to 1.0.10. Running System Update brings you to the latest packages, so you do not need to chase each release on its own.

Ask your host or a developer for help if any of these are true: you do not have root, your build number is on a major version not listed above, the upgrade keeps stopping on blockers, or a client site depends on PHP 7.4, 8.0 or 8.1 and you cannot test an upgrade yourself.

The one message worth forwarding

If you are on shared hosting or a managed server, copy this and send it to your host:

"Hi, could you confirm our server has the cPanel and WHM internal PHP security update from 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, fixed in builds 138.0.18, 136.0.50, 134.0.66 and 110.0.153)? Could you also confirm EasyApache 4 release 25.94 from 4 November 2026 is installed, so PHP 7.4, 8.0 and 8.1 report 7.4.34, 8.0.31 and 8.1.35, and PHP 8.2 to 8.5 are at 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later? Thank you."

Your websites and cPanel itself use separate PHP, so check the build number and the EasyApache versions, and you will know for sure.