Update your PHP ASAP 🚨

Yes -- all levels of accounts (Free, Pro, Enterprise)

Cloudflare is helping protect yourdomain.com against php2shell

Cloudflare has deployed rules that help block known php2shell attacks. This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version.

CWP updated PHP in 1.21, which is good.

Others still haven't released fixes. :/

FYI: If anyone doesn't know, Cloudflare's WAF is built using the OWASP CRS Ruleset as the base.
Just as many other's are as well, then tweaked.

Until a CWP update silently update the internal PHP to a 8.2+ version, is RECOMMENDED to close all the ports used by the panel.

Well, unless you live behind Cloudflare as I do. They already have mitigations in place to block malicious PHP2shell traffic. But yes, hopefully the devs get on to 8.3 or 8.5 for CWP's internal version. 7.2 is long past old in the tooth and more of the fossilized relic class.

Cloudflare indeed have protections agains this, but do nothing to protect CWP panel itself.
The mitigations from Cloudflare are only to the proxy domains - that you probably don't have in the URL of the server with CWP (and you shouldn't, since is not intended to that use and cause issues). Or even with the server IP access itself...
In fact, Cloudflare itself completly ignores the traffic in certain ports - like the 2087 and similar.

So:
Cloudflare CAN protect your websites.
Cloudflare DOESN'T protect your CWP panel or server, along with services in it, like RoundCube.


The lockdown at firewall level of all the ports continues to be RECOMMENDED

Running that now...

Why isn't CWPRO7 distributing this update?
What's the issue with their development team?

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

Running that now...

Why isn't CWPRO7 distributing this update?
What's the issue with their development team?

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

CWP 1.21 came out last night, and has all the currently support php.net versions wit the fixes for 8.2, 8.3, 8.4, 8.5

If you don't have 1.21, that means your autoupdate failed or your have the cron disabled.

You can manually update using the Update CWP button in the GUI or from the /scripts directory with ./update_cwp

Thnx!

Building PHP right now...

That update was pretty decent. However the the CWPRO7 software is still an issue?
Patched 7.4 branches do exist, my cPanel server has them.

Running that now...

Why isn't CWPRO7 distributing this update?
What's the issue with their development team?

This is urgent: Could someone from the CWP team let us know when updated PHP packages will be released?
For example, PHP 8.3 is currently at version 8.3.35, but CWP only offers 8.3.33.

It is critical that CWP makes the latest upstream PHP releases available promptly.

CWP 1.21 came out last night, and has all the currently support php.net versions wit the fixes for 8.2, 8.3, 8.4, 8.5

If you don't have 1.21, that means your autoupdate failed or your have the cron disabled.

You can manually update using the Update CWP button in the GUI or from the /scripts directory with ./update_cwp

Thnx!

Building PHP right now...

That update was pretty decent. However the the CWPRO7 software is still an issue?
Patched 7.4 branches do exist, my cPanel server has them.

CWP uses the Official PHP version from php.net.
Once a version goes EOL, there is nothing for CWP to grab and build.

Not sure how cPanel has PHP 7.4 patches, since PHP.net doesn't have any, and it is an EOL product.
Unless cPanel is doing in-house somehow. Then it isn't an Official php.net version.
Which is OK.

I know TuxCare offers additional support for Kernels, etc.
https://tuxcare.com/endless-lifecycle-support/

The versions 8.1, 8.0 and 7.4 has received the patch also, on the php official github:

https://github.com/php/php-src

They offer it only as source, so you would need to build them as you need. From what I know, it might appear the fix for lower versions too, still only by source, but it's not known when.
So CWP took the backported version directly from php github, same did cPanel.

Thnx!

Building PHP right now...

That update was pretty decent. However the the CWPRO7 software is still an issue?
Patched 7.4 branches do exist, my cPanel server has them.

CWP uses the Official PHP version from php.net.
Once a version goes EOL, there is nothing for CWP to grab and build.

Not sure how cPanel has PHP 7.4 patches, since PHP.net doesn't have any, and it is an EOL product.
Unless cPanel is doing in-house somehow. Then it isn't an Official php.net version.
Which is OK.

I know TuxCare offers additional support for Kernels, etc.
https://tuxcare.com/endless-lifecycle-support/

All the recent cPanel versions use internally PHP 8.x
v116 was the last version of cPanel to use PHP 8.1 internally - and was patched agains this bug.
PHP 7.x was used in cPanel v108 and below - this version is itself EOL since 2023, and no, it didn't get a PHP patch to this exploit.
But is a EOL version, so...

In the other side, CWP still uses PHP 7.x internally, and continue to use. So the panel itself IS vulnerable - and every single server with CWP - until this is updated to a recent PHP 8.2+ version.

The versions 8.1, 8.0 and 7.4 has received the patch also, on the php official github:

https://github.com/php/php-src

They offer it only as source, so you would need to build them as you need. From what I know, it might appear the fix for lower versions too, still only by source, but it's not known when.
So CWP took the backported version directly from php github, same did cPanel.

It was provided source-backports that must be build to those EOL versions - they are NOT in the default build of that versions.
https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619

But even with that:
CWP uses internally PHP 7.1, so there is no patch included to prevent this - since there was no source-backports to that version.

In short: there is NO way that CWP can be updated to fix this vulnerability without a PHP upgrade.

Hi guys,

CWP for Almalinux uses PHP 7.2.

To apply the patch for php 7.2:

Code: [Select]

cd /usr/src/
wget https://www.php.net/distributions/php-7.2.34.tar.gz
tar -xvzf php-7.2.34.tar.gz
cd php-7.2.34
wget https://beinhost.com/php-7.2/php72.patch
patch -p0 < php72.patch

and then compile php from sources.

I used this method and updated the internal php for CWP successfully.

Output of internal php:

# /usr/local/cwp/php71/bin/php -v

Code: [Select]

PHP 7.2.34 (cli) (built: Oct 22 2026 12:03:27) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with the ionCube PHP Loader + ionCube24 v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.


new cwp released, this is a major BIG update so possible issues.

CWP PHP 8.3 BIG Update
- user panel update to php 8.3
- admin panel updated to php 8.3
- api update to php 8.3

cwp big security update
Dkim manager faster loading
a lot of bugs resolved

updates are automatic, to update manually run 2x  times
/scripts/update_cwp

* issues are possible because this was an urgent release because of PHP security issues

Great, glad to see djprmf's major concern is addressed! I will sleep better at night now.

new cwp released, this is a major BIG update so possible issues.

CWP PHP 8.3 BIG Update
- user panel update to php 8.3
- admin panel updated to php 8.3
- api update to php 8.3

cwp big security update
Dkim manager faster loading
a lot of bugs resolved

updates are automatic, to update manually run 2x  times
/scripts/update_cwp

* issues are possible because this was an urgent release because of PHP security issues

did it and still says it runs old 7.1

Code: [Select]

[root@srv1 config]# ps aux | grep php
root     1188344  0.0  0.0 510548 42716 ?        Ss   Oct22   0:02 php-fpm: master process (/opt/alt/php-fpm82/usr/etc/php-fpm.conf)
root     1188353  0.0  0.0 511824 42896 ?        Ss   Oct22   0:03 php-fpm: master process (/opt/alt/php-fpm83/usr/etc/php-fpm.conf)
root     1188362  0.0  0.0 480312 41928 ?        Ss   Oct22   0:02 php-fpm: master process (/opt/alt/php-fpm84/usr/etc/php-fpm.conf)
root     1188371  0.0  0.0 484988 43092 ?        Ss   Oct22   0:02 php-fpm: master process (/opt/alt/php-fpm85/usr/etc/php-fpm.conf)
root     1881038  0.0  0.0 303820 26920 ?        Ss   01:56   0:00 php-fpm: master process (/usr/local/cwp/php71/etc/cwpsrv.conf)
root     1881042  0.0  0.0 304140 27120 ?        Ss   01:56   0:00 php-fpm: master process (/usr/local/cwp/php71/etc/php-fpm.conf)
root     1881060  0.2  0.0 306632 19700 ?        S    01:56   0:00 php-fpm: pool cwpsrv
root     1881061  0.2  0.0 306632 19780 ?        S    01:56   0:00 php-fpm: pool cwpsrv
root     1881062  0.2  0.0 306632 19856 ?        S    01:56   0:00 php-fpm: pool cwpsrv
Edit:

Strange just opened phpmyadmin from admin panel and shows me version 8.3.36 like updated already even it shows php71 running on server. I m confused yet there it is port domain:2031/pma/........ and it says 8.3.36 

Do we still need to select php 8.3.36 to fully fix this after the update? I updated, but cwp is still running 7.4.33