PHP Foundation: Critical PHP Security Releases (8.5.12, 8.4.27, 8.3.36, 8.2.35)

Hello everyone,

Just sharing a heads-up regarding today's critical PHP security releases (8.5.12, 8.4.27, 8.3.36, and 8.2.35) which patch important RCE vulnerabilities (CVE-2026-109618 / CVE-2026-109619).

Since these newly released versions are not yet populated in the default CWP PHP Selector/Easy::PHP interface, does anyone know the proper procedure to manually trigger or force the compilation of these specific patch versions within CWP right now?

Is there a way to update the version manifest or safely compile them manually without breaking the CWP PHP handler integration?

Thanks for any insights or workarounds!

Best regards,

I set this up on my servers:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

It has updated all the sec releases flawlessly.

I did a EL8 server by hand now.

Now working on the EL7 servers.

In case the devs are reading this, there are backports for this issue: https://x.com/SchizoDuckie/status/2112915695713517604?s=20

Will the CWP developers care enough to provide some clarification, or are we left to fend for ourselves?

Will the CWP developers care enough to provide some clarification, or are we left to fend for ourselves?

No idea. I have opened a support ticket this morning. Every other panel we manage has released a patch within an hour.

I realized a long time ago that CWP is, for all intents and purposes, somewhat abandoned. It has many bugs that "Claude" has fixed—in fact, he even patched the entire PHP setup, including the versions used by CWP and suPHP; it’s the only thing we have left.

I set this up on my servers:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

It has updated all the sec releases flawlessly.

TY!
Confirming this worked perfectly! Used to update PHP Selector, PHP-FPM Selector and PHP Switcher to latest binaries from cli.