cPanel EasyApache 4 v25.91: PHP2Shell CVE Fixes, libcurl & Podman 503 Fix

1. PHP2Shell CVE-2026-109618 and CVE-2026-109619

Both PHP2Shell vulnerabilities carry a CVSS v4.0 score of 9.2 (Critical). Because the flaws reside in the core PHP engine's request handling, traditional CMS updates (like WordPress or Joomla) offer zero protection.

• PHP Package Coverage: EasyApache 4 v25.91 patches ea-php74 through ea-php85. The fixes are backported to the older PHP 7.4, 8.0, and 8.1 package branches, while newer branches receive updated upstream PHP releases. Administrators should still plan migrations away from upstream-EOL PHP versions.
• Legacy PHP (CloudLinux Exception): Standard cPanel EasyApache 4 packages listed in v25.91 cover ea-php74 through ea-php85. CloudLinux maintains a separate package matrix that includes older PHP branches (down to PHP 5.2). For PHP versions older than 7.4, administrators should verify the exact patched package with their vendor or ELS provider rather than assuming that standard cPanel EA4 coverage applies.

2. Updating ModSecurity and Reviewing WAF Rules

EasyApache 4 updates ea-modsec30 from 3.0.16 to 3.0.17, incorporating seven CVE fixes and one additional GHSA security fix.

Administrators should verify that the updated ModSecurity engine is active and that their OWASP Core Rule Set deployment is independently maintained and current.

3. Fixing cPanel 503 Errors After Account Restore

The EA4-338 fix addresses a specific ea-podman restore scenario where reassigned container ports leave web application proxies pointing to outdated destinations. The updated package automatically re-points web application proxies at the end of a user-run restore, so accounts whose container ports were reassigned can return to serving traffic instead of returning HTTP 503 errors.

(Note: Other HTTP 503 errors may still result from PHP-FPM failures, Apache configuration issues, unavailable upstream services, or incorrect proxy settings).

4. Troubleshooting ea-podman with CloudLinux CageFS

If you run CloudLinux and face namespace initialization failures for caged users, CageFS is likely masking the rootless [email protected].

To apply this specific workaround safely via SSH:

# Define target user variables (Replace with actual values)
USERNAME="cpaneluser"
USER_UID="1001"

# 1. Update ea-podman first
dnf update ea-podman

# 2. Unmask the user service persistently
touch /opt/cloudlinux/flags/enabled-flags.d/disable-systemd-user-mask.flag

# 3. Reinstall hooks
cagefsctl --hook-install

# 4. Verify unmasking (Output should be 'static', not 'masked')
systemctl is-enabled [email protected]

# 5. Enable unprivileged user namespaces
echo "user.max_user_namespaces = 15076" > /etc/sysctl.d/99-ea-podman.conf
sysctl --system

# 6. Enable lingering and stop existing user service
loginctl enable-linger "$USERNAME"
systemctl stop "user@${USER_UID}.service"

# 1. Uninstall affected containers using the documented procedure
# (Repeat for each deployed container)
ea-podman uninstall CONTAINER_NAME --verify

# 2. Restore the default systemd user-service masking
rm -f /opt/cloudlinux/flags/enabled-flags.d/disable-systemd-user-mask.flag
cagefsctl --hook-install

# 3. Restore the user namespace limit
rm -f /etc/sysctl.d/99-ea-podman.conf
sysctl -w user.max_user_namespaces=0

# 4. Disable lingering and stop the user's service
loginctl disable-linger "$USERNAME"
systemctl stop "user@${USER_UID}.service"

# 5. Verify the rollback
sysctl user.max_user_namespaces
systemctl is-enabled [email protected]
loginctl show-user "$USERNAME" -p Linger

(Note: Ensure user.max_user_namespaces returns to your system's expected default state; it may not be exactly 0 if configured elsewhere).

5. Updating EasyApache PHP and cPanel Internal PHP

cPanel operates two independent PHP environments that must be patched separately. Run the update workflow appropriate to your server's configured settings.

Minimum Fixed Builds for cPanel Internal PHP:
The cPanel components (WHM, Roundcube) are patched in the following minimum builds:

• Build 138: 138.0.18
• Build 136: 136.0.50
• Build 134: 134.0.66
• Build 110: 110.0.153

Command-Line Update Procedure:

# 1. Refresh repository metadata (CentOS/RHEL/CloudLinux)
yum clean all && yum makecache

# 2. To update EasyApache 4 and cPanel-managed system packages:
/scripts/update-packages

# 3. To update cPanel's internal PHP explicitly:
/scripts/autorepair update_cpanel_php8

# 4. To execute the full cPanel & WHM core update workflow (which also invokes package updates):
/scripts/upcp

# 5. Restart services to load patched binaries into active workers
/scripts/restartsrv_httpd
/scripts/restartsrv_apache_php_fpm

(LiteSpeed users must use the supported LiteSpeed restart or graceful-restart procedure for their installed configuration. Confirm that the procedure safely cycles the relevant PHP workers and that old processes are no longer serving requests).

6. Package-Level Verification and Runtime Validation

Running php -v is insufficient. Because cPanel and OS vendors backport security fixes to legacy branches, the version string will often not change.

To verify installed CLI packages, query the RPM changelog:

for v in 74 80 81 82 83 84 85; do
    pkg="ea-php${v}-php-cli"
    if rpm -q "$pkg" >/dev/null 2>&1; then
        echo "===== PHP ${v} ====="
        rpm -q --changelog "$pkg" | \
            grep -E -m 5 'CVE-2026-109618|CVE-2026-109619' \
            || echo "No matching CVE entry found - investigate package version and vendor changelog."
    fi
done

On supported cPanel operating systems, use the package manager and vendor-provided changelog format to verify the installed package. Do not assume that RPM-based verification commands apply to every distribution.