Recent posts

#31

Updates / Re: CWP New Version Released 1...

Last post by overseer - October 30, 2026, 06:13:00 PM

That should be in a separate thread. Hopefully coming soon!

#32

PHP / Re: Secure PHP versions in CWP...

Last post by overseer - October 30, 2026, 06:11:32 PM

Thank you very much for the clear communication -- it and your efforts are very much appreciated!

[Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages]

#33

PHP / Secure PHP versions in CWP: se...

Last post by Administrator - October 30, 2026, 03:58:15 PM

Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages

Hello everyone,

Here is an overview of the PHP security work in the latest CWP releases (1.27 / 1.28): which PHP versions are safe to use, which older versions we patch ourselves, and the new ready-made PHP packages that install in seconds instead of compiling.


1. Supported PHP versions (recommended)

These PHP branches still receive official security fixes. CWP always builds the newest release of each branch:

PHP	Version in CWP
8.2	8.2.35
8.3	8.3.36 (default PHP for websites and the panel)
8.4	8.4.27
8.5	8.5.12

If your sites can run on PHP 8.2 or newer, use one of these.


2. Older (end-of-life) PHP versions with the CWP security patch

Many sites still need older PHP. These versions no longer get fixes from php.net, so CWP builds them from its own sources with a security backport for the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619):

PHP	Patched version
5.4	5.4.45
5.5	5.5.38
5.6	5.6.40
7.0	7.0.33
7.1	7.1.33
7.2	7.2.34
7.3	7.3.33
7.4	7.4.33
8.0	8.0.30
8.1	8.1.31 and 8.1.34

How to recognise a patched build: the version ends with pl-cwpsec, for example:

Code Select Expand

/opt/alt/php-fpm74/usr/bin/php -v
PHP 7.4.33pl-cwpsec (cli) ...In the CWP admin panel (PHP Selector / PHP-FPM Selector) installed patched versions show a green secured label.

Your server has an older build without "pl-cwpsec"? Rebuild or reinstall that version once (PHP-FPM Selector, PHP Selector or PHP Switcher). Every new build of the versions above uses the patched sources automatically.

Note: the patch is a security mitigation, it does not make an end-of-life PHP "supported" again. As part of the fix, PHP session upload progress is disabled in these versions (upload progress bars stop working; uploads themselves work normally). Please plan the move to PHP 8.2+ where you can.


3. Ready-made PHP packages (RPMs) from the CWP repository

CWP now ships ready-made, tested PHP packages built with the default CWP build options. When you install a PHP version with the default options, the panel installs the package in a few seconds instead of compiling for 10-30 minutes:

• cwp-php-fpmNN - PHP-FPM Selector versions (/opt/alt/php-fpmNN)
• cwp-php-cgiNN - PHP Selector (CGI) versions (/opt/alt/phpNN)
• cwp-php-switcherNN - PHP Switcher version (/usr/local, the default PHP for websites)

Available versions:

• CentOS 7 / AlmaLinux 8 / Rocky 8 (EL7, EL8): PHP 5.6 - 8.5
• AlmaLinux 9 / Rocky 9 (EL9): PHP 7.4 - 8.5

The packages of the end-of-life versions (5.6 - 8.1) already contain the CWP security patch (pl-cwpsec).

Good to know:

• Your php.ini, php-fpm.conf and extra php.d settings are kept when a package is installed or updated.
• If you choose your own build options, CWP compiles from source exactly as before. If a package is not available, it also falls back to compiling.
• A normal "yum update" / "dnf update" never changes your PHP version on its own.
• The nightly PHP auto-update uses the packages too.
• PHP 8.3, 8.4 and 8.5 built with the ionCube option now get the matching ionCube loader. If ionCube was missing after a build, rebuild or reinstall the version once.

4. New installations

The new CWP installer installs PHP from these packages as well. PHP-FPM versions can be added during the installation:

Code Select Expand

cd /usr/local/src
curl -Lo cwp-latest http://centos-webpanel.com/cwp-latest
sh cwp-latest --phpfpm 7.4,8.3A complete installation takes about 3 minutes on AlmaLinux / Rocky 8 and 9 (about 10 minutes on CentOS 7). Full guide: https://control-webpanel.com/installation-instructions


Update your CWP to the latest version (sh /scripts/update_cwp or wait for the nightly update) to get all of this. If something does not work as expected, please reply here or open a ticket.

Changelog: https://control-webpanel.com/changelog

Regards,
CWP Team

#34

CentOS-WebPanel Bugs / Re: 500 in cwp

Last post by setecabanas - October 30, 2026, 03:35:39 PM

fixed
yum update cwpphp
sh /scripts/update_cwp

#35

Updates / Re: CWP New Version Released 1...

Last post by Silky1284 - October 30, 2026, 03:26:43 PM

What's new in v1.28?

#36

CentOS-WebPanel Bugs / 500 in cwp

Last post by setecabanas - October 30, 2026, 02:53:02 PM

I have this 500 error when i tried to access my cwp panel:2031

2026/10/30 15:50:59 [error] 3574753#0: *44617 FastCGI sent in stderr: "PHP message: PHP Fatal error:  The file /usr/local/cwpsrv/htdocs/admin/index.php cannot be decoded
by this version of the ionCube Loader.
 If you are the administrator of this site
then please install the latest version of the ionCube Loader.

Any idea?

#37

CentOS-WebPanel Bugs / Re: How to fix warning: AutoSS...

Last post by chrisg - October 30, 2026, 01:51:26 PM

That helped indeed, thank you! The update wasn't available here when I asked.

#38

PHP Selector / Re: PHP 8.4/8.5 selector depen...

Last post by josemnunez - October 30, 2026, 12:30:38 PM

Please update to the latest version.

#39

Updates / Re: CWP New Version Released 1...

Last post by josemnunez - October 30, 2026, 12:28:32 PM

Yes

#40

Updates / Re: CWP New Version Released 1...

Last post by ghoste - October 30, 2026, 12:26:58 PM

oh my gosh, he looks great!!!!!
Finally... can I migrate my outdated servers (CentOS 7) to AlmaLinux 9?