CWP system PHP 8.3.36 UPDATE (CVE)

new cwp released, this is a major BIG update so possible issues.

CWP PHP 8.3 BIG Update
- user panel update to php 8.3
- admin panel updated to php 8.3
- api update to php 8.3

cwp big security update
Dkim manager faster loading
a lot of bugs resolved

updates are automatic, to update manually run 2x  times
/scripts/update_cwp

* issues are possible because this was an urgent release because of PHP security issues

Thanks so very much! This is very good news.

new cwp released, this is a major BIG update so possible issues.

CWP PHP 8.3 BIG Update
- user panel update to php 8.3
- admin panel updated to php 8.3
- api update to php 8.3

cwp big security update
Dkim manager faster loading
a lot of bugs resolved

updates are automatic, to update manually run 2x  times
/scripts/update_cwp

* issues are possible because this was an urgent release because of PHP security issues

Hi @Administrator,

After updating CWP to the latest release with **PHP 8.3.36**, I identified two critical issues affecting the Email Accounts modules in both the Admin Panel (port 2031) and User Panel (port 2083).

The update completed successfully, and PHP 8.3.36 is running correctly. However, the email account listing functionality is broken.

**1. Admin Panel (Port 2031) – Mail List Module**

Affected module: `mail_list`

Request:
`loader_ajax.php?ajax=mail_list&acc=list`

Result: **HTTP 500 Internal Server Error / DataTables Ajax error**

PHP-FPM logs:

```text
PHP Warning: Undefined array key "acc"
PHP Warning: Undefined variable $hostname
PHP Warning: Undefined variable $key

PHP Fatal error: Uncaught TypeError:
Unsupported operand types: string / int

File:
/usr/local/cwpsrv/htdocs/resources/admin/addons/ajax/ajax_mail_list.php:0
```

The Mail List page opens, but the mailbox table fails to load.

**2. User Panel (Port 2083) – Email Accounts Module**

The user-facing Email Accounts module is also affected.

PHP-FPM logs:

```text
PHP Warning: Array to string conversion

File:
modules/cwp_framework/classes/CWPHttpRequest.php:0

PHP Fatal error: Uncaught TypeError:
Cannot access offset of type string on string

File:
modules/email_accounts/index.php:0

Stack trace:
EmailManager->dataTableEmailColOrder()
EmailManager->dataTableEmail()
```

**3. Environment**

- OS: Rocky Linux 8.10
- CWP: Latest update released October 23, 2026
- Internal PHP CLI: 8.3.36
- Internal PHP-FPM: 8.3.36
- ionCube PHP Loader: 15.5.1
- MariaDB: 10.3.x

Both affected email modules have file modification timestamps from October 23, 2026.

The errors appear to be PHP 8.x compatibility issues involving invalid operand types and array/string handling.

**@Administrator, could you please check these two modules and release a fix?**

The PHP upgrade itself appears successful, but mailbox management through the CWP interface is currently affected.

Thank you!

See this in email stats goaccess last 2 days, and can confirm this email list problem too.

I can also confirm the bug with the email listing.
Is giving the same error in every server CWP that i have updated.

Dear all, has this issue been resolved? I would like to proceed with the upgrade, but I am concerned about encountering an error.

I'm confused.

On Alma 8.1 & CWP 1.23 (PHP FPM all updated to patched version). The CWP services however are still running on the existing PHP 7.2 runtime.

I can see the new update script, I imagine it is supposed to install the 8.3 update (/scripts/update_cwpphp83). This script though doesn't seem to be called by the cron when I run /scripts/update_cwp, twice or otherwise. I haven't run it directly as not sure what it will do.

/usr/local/cwp/.conf/.cwpphp83.done does not exist.

I'm thinking the bones are there but for me the update is not being tiggered.

 
truly grateful to hear this news.

Hmm, the plot thickens. Seems my server cannot resolve dl1.centos-webpanel.com to receive the update due to dns issues (though google dns can /scratches head).

DNS check   Result
ns1.hrvatski-hosting.com   158.69.227.165
ns2.hrvatski-hosting.com   158.69.227.165
Vultr resolver 108.61.10.10   NXDOMAIN
Cloudflare resolver 1.1.1.1   NXDOMAIN

I changed the server dns to google but no luck with triggering the download/install

I too confirm the bug with the email listing.
i check using the chat gpt for help its says
The log confirms that the failure is in CWP's mail-account listing AJAX handler, not in the general Apache web server.
The relevant file is:

/usr/local/cwpsrv/htdocs/resources/admin/addons/ajax/ajax_mail_list.php
At 12:23:33 and again at 12:26:43 on 25 October 2026, the log reports these PHP errors:
- Undefined array key "acc"
- Undefined variable $hostname
- Undefined variable $key
- Fatal error: Uncaught TypeError: Unsupported operand types: string / int
The request is routed through loader_ajax.php with ajax=mail_list&acc=list. The handler crashes before it can return the JSON that DataTables expects, which explains the popup.

The missing variables may indicate a problem in the handler's initialization or a mismatch between the installed CWP code and its expected parameters.

if any one has the file in v1.23 can upload it so that we can check replcing that file

seems i received the update automatically, in my case i can reach my websites, but webmail reports gateway error and the cwp admin panel also reports 502 bad gateway.

I have no other way than asking AI to investigate and fix this, not sure what else i could do, ssh is still available so i can try if there is another update out now

ok, in this case AI was helpful.



After the recent CWP PHP update, both the CWP Admin Panel and the user panel/webmail became unavailable. The CWP services returned **502 Bad Gateway** errors, while the hosted websites continued to work.

### Root cause

The internal CWP PHP binary at `/usr/local/cwp/php71/bin/php` is now PHP 8.3.36, built on October 22, 2026.

Both CWP PHP-FPM services failed to start with:

```text
PHP Fatal error: Unable to start pcre module in Unknown on line 0
```

The PHP binary was loading the following library from `/usr/local/lib`:

```text
libpcre2-8.so.0 -> /usr/local/lib/libpcre2-8.so.0.10.4
```

The system also has a distribution-provided PCRE2 library at:

```text
/lib64/libpcre2-8.so.0 -> libpcre2-8.so.0.7.1
```

Testing confirmed that PHP failed with the library from `/usr/local/lib`, but started successfully when `/lib64` was explicitly selected through `LD_LIBRARY_PATH`.

### Solution / workaround

I created systemd drop-in overrides for both CWP PHP-FPM services:

Files:
- `/etc/systemd/system/cwpsrv-phpfpm.service.d/pcre-library.conf`
- `/etc/systemd/system/cwp-phpfpm.service.d/pcre-library.conf`

Contents of both files:

```ini
[Service]
Environment="LD_LIBRARY_PATH=/lib64"
```

Then I executed:

```bash
systemctl daemon-reload
systemctl restart cwpsrv-phpfpm cwp-phpfpm
```

### Results

- Both PHP-FPM services started successfully.
- The missing PHP-FPM sockets were recreated.
- The local CWP HTTPS endpoint returned HTTP 302 instead of HTTP 502.
- The CWP Admin Panel and webmail became accessible again.
- The hosted websites continued working throughout the troubleshooting.

### Additional information

The CWP PHP update log also contained:

```text
php is not 8.3 after install, marker NOT written (will retry next cron)
```

This suggests that the PHP update did not complete successfully.

**Question:** Has anyone else encountered this PCRE startup failure after the recent CWP PHP 8.3 update? Is there an official fix for the PCRE2 library conflict or an incomplete update, rather than relying on the systemd `LD_LIBRARY_PATH` workaround?

Look at /usr/local/cwpsrv/logs/error_log
In my case I had a 500 error recently due to the BIG update failing in the transition to the backend being on 8.3. Maybe it was my provider doing scheduled network maintenance Thursday night, or there may have been a conflict with Sandeep's php-manager. There was a mismatch of Ioncube loader versions and bad PHP syntax keeping CWP from loading. Admin panel just read:

No Loader is installed, please try to run this command or contact support: sh /scripts/update_ioncube

I tried emerysteele's PCRE workaround in the other main PHP thread, but that just resulted in a 500 error due to PHP syntax version differences between the old CWP 7.2 backend and the new 8.3.36. So I had to revert back to the previous ldconfig:

Code: [Select]

mv /root/pcre2_local_backup/* /usr/local/lib/ && ldconfigMy self-help fix was to remove the MARK file and edit.the PHP 8.3 upgrade script:

Code: [Select]

/scripts/update_cwpphp83I just commented out the MARK logic to get the script to re-run manually. After a while, it worked to reinstall the admin panel!

https://www.alphagnu.com/topic/633-standalone-cwp-php-cli-build-manager-build-php-7485-php-fpm-selector-switcher-and-pie-extensions/

i used AlphaGnu ,method for update php version is far better than cwp inbuilt selector or switcher they are still have bugs once the automatic update is enabled cwp will start the update but the problem is pcre failure so php will not start will givea fatal error
so install the alphagnu and select the autoupdate disabled in cwp php selector for both cli and fpm