Update your PHP ASAP 🚨

Has anyone seen any BIG issues with the BIG update??

I'm almost hesitate to update the cwp because the last thing I need is anymore BIG problems. I'm working to get everything running on the newest patch versions of PHP.

One AlmaLinux 8 server updated flawlessly, another AL8 server now won't load the admin panel. Message reads:

No Loader is installed, please try to run this command or contact support: sh /scripts/update_ioncube

At least sites & e-mail are still functioning fine on the troubled server.

CWP is using PHP 8.3.36 for its updater, command-line scripts and web interface:

/usr/local/cwp/php71/bin/php

The php71 folder name is historical I guess, it does not reflect the installed version 8.3.36.

new cwp released, this is a major BIG update so possible issues.

CWP PHP 8.3 BIG Update
- user panel update to php 8.3
- admin panel updated to php 8.3
- api update to php 8.3

cwp big security update
Dkim manager faster loading
a lot of bugs resolved

updates are automatic, to update manually run 2x  times
/scripts/update_cwp

* issues are possible because this was an urgent release because of PHP security issues

Hi @Administrator,

After updating CWP to the latest release with PHP 8.3.36, I identified two critical issues affecting the Email Accounts modules in both the Admin Panel (port 2031) and User Panel (port 2083).

The update completed successfully, and PHP 8.3.36 is running correctly. However, the email account listing functionality is broken.

1. Admin Panel (Port 2031) – Mail List Module

Affected module: mail_list

Request:
loader_ajax.php?ajax=mail_list&acc=list

Result: HTTP 500 Internal Server Error / DataTables Ajax error

PHP-FPM logs:

PHP Warning: Undefined array key "acc"
PHP Warning: Undefined variable $hostname
PHP Warning: Undefined variable $key

PHP Fatal error: Uncaught TypeError:
Unsupported operand types: string / int

File:
/usr/local/cwpsrv/htdocs/resources/admin/addons/ajax/ajax_mail_list.php:0

The Mail List page opens, but the mailbox table fails to load.

2. User Panel (Port 2083) – Email Accounts Module

The user-facing Email Accounts module is also affected.

PHP-FPM logs:

PHP Warning: Array to string conversion

File:
modules/cwp_framework/classes/CWPHttpRequest.php:0

PHP Fatal error: Uncaught TypeError:
Cannot access offset of type string on string

File:
modules/email_accounts/index.php:0

Stack trace:
EmailManager->dataTableEmailColOrder()
EmailManager->dataTableEmail()

3. Environment

OS: Rocky Linux 8.10

CWP: Latest update released October 23, 2026

Internal PHP CLI: 8.3.36

Internal PHP-FPM: 8.3.36

ionCube PHP Loader: 15.5.1

MariaDB: 10.3.x

Both affected email modules have file modification timestamps from October 23, 2026.

The errors appear to be PHP 8.x compatibility issues involving invalid operand types and array/string handling.

@Administrator, could you please check these two modules and release a fix?

The PHP upgrade itself appears successful, but mailbox management through the CWP interface is currently affected.

Thank you!

new cwp released, this is a major BIG update so possible issues.

CWP PHP 8.3 BIG Update
- user panel update to php 8.3
- admin panel updated to php 8.3
- api update to php 8.3

cwp big security update
Dkim manager faster loading
a lot of bugs resolved

updates are automatic, to update manually run 2x  times
/scripts/update_cwp

* issues are possible because this was an urgent release because of PHP security issues

now I cant access user or admin panels. I get 502 bad gateway error. console log:

Code: [Select]

[root@server /]# /scripts/update_cwp


====================================================
============= CentOS Web Panel Cron ================
====================================================


###########################
Firewall Flush Daily Blocks
###########################


######################
Update Server Packages
######################
Redirecting to /bin/systemctl restart cwpsrv.service
Redirecting to /bin/systemctl restart cwp-phpfpm.service
Redirecting to /bin/systemctl reload cwpsrv.service
Redirecting to /bin/systemctl reload cwp-phpfpm.service
Redirecting to /bin/systemctl restart cwpsrv.service
Redirecting to /bin/systemctl restart httpd.service
Redirecting to /bin/systemctl reload httpd.service
Redirecting to /bin/systemctl reload nginx.service
Redirecting to /bin/systemctl reload httpd.service
[root@server /]# /scripts/update_cwp


====================================================
============= CentOS Web Panel Cron ================
====================================================


###########################
Firewall Flush Daily Blocks
###########################


######################
Update Server Packages
######################
Redirecting to /bin/systemctl restart cwpsrv.service
Redirecting to /bin/systemctl restart httpd.service
Redirecting to /bin/systemctl reload httpd.service
Job for httpd.service failed.
See "systemctl status httpd.service" and "journalctl -xe" for details.
Redirecting to /bin/systemctl reload nginx.service
Redirecting to /bin/systemctl reload httpd.service
[root@server /]# systemctl status httpd.service
● httpd.service - Web server Apache
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: active (running) since Fri 2026-10-23 22:29:43 MDT; 48s ago
 Main PID: 97283 (httpd)
    Tasks: 109 (limit: 203284)
   Memory: 340.7M
   CGroup: /system.slice/httpd.service
           ├─97283 /usr/local/apache/bin/httpd -k start
           ├─98162 /usr/local/apache/bin/httpd -k start
           ├─98164 /usr/local/apache/bin/httpd -k start
           ├─98166 /usr/local/apache/bin/httpd -k start
           └─98634 /usr/local/apache/bin/httpd -k start

Oct 23 22:29:44 server.server.io apachectl[97316]: AH00015: Unable to open logs
Oct 23 22:29:44 server.server.io apachectl[97316]: httpd not running, trying to start
Oct 23 22:29:44 server.server.io systemd[1]: httpd.service: Control process exited, cod>
Oct 23 22:29:44 server.server.io systemd[1]: Reload failed for Web server Apache.
Oct 23 22:29:48 server.server.io systemd[1]: Reloading Web server Apache.
Oct 23 22:29:48 server.server.io apachectl[97878]: AH00112: Warning: DocumentRoot [/hom>
Oct 23 22:29:48 server.server.io apachectl[97878]: AH00112: Warning: DocumentRoot [/hom>
Oct 23 22:29:48 server.server.io apachectl[97878]: AH00112: Warning: DocumentRoot [/hom>
Oct 23 22:29:48 server.server.io apachectl[97878]: AH00558: httpd: Could not reliably d>
Oct 23 22:29:49 server.server.io systemd[1]: Reloaded Web server Apache.


[root@server /]# journalctl -xe
-- Unit cwp-phpfpm.service has finished starting up.
--
-- The start-up result is done.
Oct 23 22:30:57 server.server.io systemd[1]: Stopped The PHP FastCGI Process Manager.
-- Subject: Unit cwpsrv-phpfpm.service has finished shutting down
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit cwpsrv-phpfpm.service has finished shutting down.
Oct 23 22:30:57 server.server.io systemd[1]: Started The PHP FastCGI Process Manager.
-- Subject: Unit cwpsrv-phpfpm.service has finished start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit cwpsrv-phpfpm.service has finished starting up.
--
-- The start-up result is done.
Oct 23 22:30:57 server.server.io php-fpm[101615]: [23-Oct-2026 22:30:57] NOTICE: PHP me>
Oct 23 22:30:57 server.server.io php-fpm[101616]: [23-Oct-2026 22:30:57] NOTICE: PHP me>
Oct 23 22:30:57 server.server.io systemd[1]: cwp-phpfpm.service: Main process exited, c>
Oct 23 22:30:57 server.server.io systemd[1]: cwp-phpfpm.service: Failed with result 'ex>
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- The unit cwp-phpfpm.service has entered the 'failed' state with result 'exit-code'.
Oct 23 22:30:57 server.server.io systemd[1]: cwpsrv-phpfpm.service: Main process exited>
Oct 23 22:30:57 server.server.io systemd[1]: cwpsrv-phpfpm.service: Failed with result >
-- Subject: Unit failed
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- The unit cwpsrv-phpfpm.service has entered the 'failed' state with result 'exit-code'.
Oct 23 22:30:58 server.server.io kernel: Firewall: *TCP_IN Blocked* IN=eno1 OUT= MAC=3c>
lines 3445-3478/3478 (END)
[root@server /]# /scripts/update_cwp
PHP Fatal error:  Unable to start pcre module in Unknown on line 0

Looks like my machine for whatever reason was trying to use an older pcre module, even though it has newer one too?

Did this to fix it:

Code: [Select]

mkdir -p /root/pcre2_local_backup
mv /usr/local/lib/libpcre2* /root/pcre2_local_backup/
ldconfig
systemctl restart cwpsrv-phpfpm
systemctl restart cwp-phpfpm
systemctl restart cwpsrv
systemctl restart httpd
/scripts/update_cwp
Can undo with this if dont fix:

Code: [Select]

mv /root/pcre2_local_backup/* /usr/local/lib/ && ldconfig

Updating to the latest version leads to a PHP error with the PCRE module, like @emerysteele stated.
The commands provided solved the issue! Thanks emerysteele!

And indeed:

Code: [Select]

/usr/local/cwp/php71/bin/php -v
PHP 8.3.36 (cli) (built: Oct 22 2026 14:30:10) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with the ionCube PHP Loader v15.5.1, Copyright (c) 2002-2026, by ionCube Ltd.


On almalinux9, running the new php-fpm 8.3.36 and cwppro 1.23 - the internal cwp php version is still:

/usr/local/cwp/php71/bin/php -v
PHP 7.4.33 (cli) (built: Apr 26 2023 00:00:00) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with the ionCube PHP Loader + ionCube24 v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.

Apparently others run the internal 8.3.36 and not the old 7.4.33

Any suggestions why?

On almalinux9, running the new php-fpm 8.3.36 and cwppro 1.23 - the internal cwp php version is still:

/usr/local/cwp/php71/bin/php -v
PHP 7.4.33 (cli) (built: Apr 26 2023 00:00:00) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with the ionCube PHP Loader + ionCube24 v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.

Apparently others run the internal 8.3.36 and not the old 7.4.33

Any suggestions why?

I think 1.24 is the version with the php patch. At least thats what version my admin dashboard says: CWPpro version: 1.24

Run /scripts/update_cwp again?

Hmnn, yes, but the changelog says latest version is 1.23...

https://control-webpanel.com/changelog

The current version of CWP as of 2026-10-24 is 1.23

On almalinux9, running the new php-fpm 8.3.36 and cwppro 1.23 - the internal cwp php version is still:

/usr/local/cwp/php71/bin/php -v
PHP 7.4.33 (cli) (built: Apr 26 2023 00:00:00) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with the ionCube PHP Loader + ionCube24 v15.5.0, Copyright (c) 2002-2026, by ionCube Ltd.

Apparently others run the internal 8.3.36 and not the old 7.4.33

Any suggestions why?

Internal version on AL9 with CWP 1.23 is still at 7.4.33  :

Code: [Select]

# /usr/local/cwp/php71/bin/php -v
PHP 7.4.33 (cli) (built: Apr 26 2023 00:00:00) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with the ionCube PHP Loader + ionCube24 v15.5.1, Copyright (c) 2002-2026, by ionCube Ltd.
Now you PHP Base version is controlled by PHP Switcher.
And can be whatever version you want.

Hi Starburst, - I donīt see an option to update the internal PHP version from the present 7.4.33 to eg 8.3.36 og even chose another version than CWP has decided
As I understand the internal PHP version is a version cwp modifies to fit cwp and not out-of-the-box version php

I do however see others that run a 8.3.36 version on the internal version, so somewhere there must be an option to have the internal php version made up-to-date

Hi Starburst, - I donīt see an option to update the internal PHP version from the present 7.4.33 to eg 8.3.36 og even chose another version than CWP has decided
As I understand the internal PHP version is a version cwp modifies to fit cwp and not out-of-the-box version php

I do however see others that run a 8.3.36 version on the internal version, so somewhere there must be an option to have the internal php version made up-to-date

Again, CWP uses an Internal version of PHP 7.4.33...

I have never seen an Internal version of anything other than that.

What might be getting someone confused is there is the Internal version, Base version, and the PHP-FPM's version(s).

Internal version is at 7.4.33, and can not be changed by end users.

Base (aka PHP CLI) version can be set to anything with PHP Switcher.

PHP-FPM version are set from the GUI's PHP-FPM Selector menu, and on AL9 can be set from 8.0 to 8.5.

? CWPs internal PHP version was updated as reported by Admin on this post: http://forum.centos-webpanel.com/php/update-your-php-asap-128680/msg54563/#msg54563

After updating my server, it reports CWPpro 1.24, and /usr/local/cwp/php71/bin/php -v is reporting it is running version 8.3.36

Code: [Select]

[root@server /]# /usr/local/cwp/php71/bin/php -v
PHP Warning:  PHP Startup: Unable to load dynamic library 'intl' (tried: /usr/local/cwp/php71/lib/php/extensions/no-debug-non-zts-20230831/intl (/usr/local/cwp/php71/lib/php/extensions/no-debug-non-zts-20230831/intl: cannot open shared object file: No such file or directory), /usr/local/cwp/php71/lib/php/extensions/no-debug-non-zts-20230831/intl.so (/usr/local/cwp/php71/lib/php/extensions/no-debug-non-zts-20230831/intl.so: cannot open shared object file: No such file or directory)) in Unknown on line 0
PHP 8.3.36 (cli) (built: Oct 22 2026 14:30:10) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.36, Copyright (c) Zend Technologies
    with the ionCube PHP Loader v15.5.1, Copyright (c) 2002-2026, by ionCube Ltd.
[root@nimbus /]#
https://imgur.com/a/ag0hYrQ

also, this shows cwpphp shows its running 8.3.36 with Build Date  : Thu 22 Oct 2026 08:31:21 AM MDT

Code: [Select]

[root@server ~]# rpm -q cwpphp
cwpphp-8.3.36-1.x86_64
[root@server ~]# rpm -qa | grep -i cwpphp
cwpphp-8.3.36-1.x86_64
[root@server ~]# rpm -qi cwpphp-8.3.36-1.x86_64
Name        : cwpphp
Version     : 8.3.36
Release     : 1
Architecture: x86_64
Install Date: Fri 23 Oct 2026 10:30:09 PM MDT
Group       : Unspecified
Size        : 116145591
License     : Proprietary License
Signature   : (none)
Source RPM  : cwpphp-8.3.36-1.src.rpm
Build Date  : Thu 22 Oct 2026 08:31:21 AM MDT
Build Host  : rpm.control-webpanel.com
Relocations : (not relocatable)
URL         : http://centos-webpanel.com/
Summary     : PHP-FPM for cwpsrv
Description :
PHP-FPM Daemon for cwpsrv
[root@server ~]#
Changelog is not up to date.