PHP Foundation: Critical PHP Security Releases (8.5.12, 8.4.27, 8.3.36, 8.2.35)

Hello everyone,

Just sharing a heads-up regarding today's critical PHP security releases (8.5.12, 8.4.27, 8.3.36, and 8.2.35) which patch important RCE vulnerabilities (CVE-2026-109618 / CVE-2026-109619).

Since these newly released versions are not yet populated in the default CWP PHP Selector/Easy::PHP interface, does anyone know the proper procedure to manually trigger or force the compilation of these specific patch versions within CWP right now?

Is there a way to update the version manifest or safely compile them manually without breaking the CWP PHP handler integration?

Thanks for any insights or workarounds!

Best regards,

I set this up on my servers:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

It has updated all the sec releases flawlessly.

I did a EL8 server by hand now.

Now working on the EL7 servers.

In case the devs are reading this, there are backports for this issue: https://x.com/SchizoDuckie/status/2112915695713517604?s=20

Will the CWP developers care enough to provide some clarification, or are we left to fend for ourselves?

Will the CWP developers care enough to provide some clarification, or are we left to fend for ourselves?

No idea. I have opened a support ticket this morning. Every other panel we manage has released a patch within an hour.

I realized a long time ago that CWP is, for all intents and purposes, somewhat abandoned. It has many bugs that "Claude" has fixed—in fact, he even patched the entire PHP setup, including the versions used by CWP and suPHP; it’s the only thing we have left.

I set this up on my servers:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

It has updated all the sec releases flawlessly.

TY!
Confirming this worked perfectly! Used to update PHP Selector, PHP-FPM Selector and PHP Switcher to latest binaries from cli.

Now working on the EL7 servers.

What's the point? CentOS 7 is a sitting duck at this point.

are the devs going to update the php versions, so we don't have to do this manually?

I set this up on my servers:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

It has updated all the sec releases flawlessly.

this worked wonderfully, thanks

I set this up on my servers:
https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

It has updated all the sec releases flawlessly.

Hi,
I am using CentOS 7 and PHP 7.4 for an email server.
I noticed that the instructions in the link only apply to EL8 or later.
How can I update PHP on CentOS 7?

Seems as though you would have to use the Remi repository. But it isn't very current with the new PHP releases from today.
https://blog.remirepo.net/post/2024/05/13/PHP-version-8.2.19-and-8.3.7

Definitely look at possible manual remediations and get behind Cloudflare's service if possible to block PHP2shell attack patterns. And try to migrate to AlmaLinux 8 ASAP.

Work for me
replicate to any version

My Server:
Almalinux 8
PHP 8.3.x

Step 1) Filemanager:  /usr/local/cwpsrv/htdocs/resources/conf/el8
any file: versions.ini
ADD: version[]=8.3.36

Example:
[8.3]
version[]=8.3.36
version[]=8.3.33
version[]=8.3.32

Step 2) go CWP Panel -> Version Switcher

a) Build PHP 8.3.36
b) Message Log: Failed to Download PHP version 8.3.36!  --> Not exist in CWP Repo... but this create "php-rebuild.sh", need this file for next step.
c) Entry console SSH with ROOT.
d) RUN this command in console:
sed -i 's|http://static.cdn-cwp.com/files/php/php-|https://www.php.net/distributions/php-|g' /usr/local/src/php-rebuild.sh
e) Build 8.3.36 again...
d) Enjoy and protect...



for PHP-FPM Selector in CWP Panel:
Console: cd /usr/local/src/

only 3 seconds for update "php-fpm-8.3.sh":
after to build 8.3.36, same time check in console:

paste in console: ls -l
check "php-fpm-8.3.sh" is not 0k
-rw-r--r--  1 root root      5256 Oct 22 04:07 php-fpm-8.3.sh   <- OK

RUN with OK:
sed -i 's|http://static.cdn-cwp.com/files/php/php-|https://www.php.net/distributions/php-|g' /usr/local/src/php-fpm-8.3.sh

Script for PHP-FPM Selector delete all files in start and end script.

i installed this using the guide:

https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

I see in my php-fpm it is running the installed versions but in the drop-down i can't select the new installed version and on the cwp dashboard i still see the old version, and also with php -v

So how can i enable it so my sites and CWP is using it i just installed the new versions for php-fpm as i am using this.

Thanks