php2shell
Menu

cPanel/WHM (EasyApache 4) and PHP2Shell

What cPanel/WHM (EasyApache 4) has said about the fix, and where to update and restart PHP in it.

What cPanel/WHM (EasyApache 4) says

EasyApache 4 25.91 (2026-10-21) updates ea-php85/84/83/82 to 8.5.12/8.4.27/8.3.36/8.2.35 and ships backported fixes for ea-php74/80/81, listing both CVEs. A separate cPanel & WHM security update (2026-10-21) patches cPanel's own internal PHP (138.0.18, 136.0.50, 134.0.66 ship PHP 8.4.27; 110.0.153 backports fixes to 8.1.34). Packages must still be installed on the server.

Update `ea-php85` from v8.5.11 to v8.5.12.
docs.cpanel.net2026-10-21Official
critical remote code execution vulnerabilities
docs.cpanel.net2026-10-21Official

Check the PHP version

WHM » Home » Software » MultiPHP Manager (cPanel: Home » Software » MultiPHP Manager) shows the version per domain. Shell: grep phpversion /var/cpanel/userdata/USERNAME/DOMAIN (sample output phpversion: ea-php81). Installed package versions: rpm -qa | grep -i <package> (docs form), e.g. package = ea-php84.

Update PHP

WHM » Home » Software » EasyApache 4 has a 'Run system update' link that opens WHM » Home » Software » System Update. Command line per docs: dnf upgrade (AlmaLinux/Rocky), yum update (CentOS), apt update then apt upgrade --purge (Ubuntu); single package form e.g. 'dnf upgrade example'. Docs say not to apt-hold EasyApache 4 packages. Changing installed PHP versions: EasyApache 4 'Customize' then 'Provision'.

Restart PHP

Docs list /usr/local/cpanel/scripts/restartsrv_apache_php_fpm --hard for Apache PHP-FPM (documented in the PrivateTmp context) and the pattern /usr/local/cpanel/scripts/restartsrv_<service> with flags --restart, --graceful, --hard. Docs do not state whether ea-php package updates restart PHP-FPM automatically. LiteSpeed uses lsphp, not MultiPHP's PHP-FPM, so this does not apply there.

Pages we read