Text only | Text with Images

Control Web Panel

WebPanel => PHP => Topic started by: Administrator on October 30, 2026, 03:58:15 PM

Title: Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages
Post by: Administrator on October 30, 2026, 03:58:15 PM
Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages

Hello everyone,

Here is an overview of the PHP security work in the latest CWP releases (1.27 / 1.28): which PHP versions are safe to use, which older versions we patch ourselves, and the new ready-made PHP packages that install in seconds instead of compiling.


1. Supported PHP versions (recommended)

These PHP branches still receive official security fixes. CWP always builds the newest release of each branch:

PHPVersion in CWP
8.28.2.35
8.38.3.36 (default PHP for websites and the panel)
8.48.4.27
8.58.5.12

If your sites can run on PHP 8.2 or newer, use one of these.


2. Older (end-of-life) PHP versions with the CWP security patch

Many sites still need older PHP. These versions no longer get fixes from php.net, so CWP builds them from its own sources with a security backport for the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619):

PHPPatched version
5.45.4.45
5.55.5.38
5.65.6.40
7.07.0.33
7.17.1.33
7.27.2.34
7.37.3.33
7.47.4.33
8.08.0.30
8.18.1.31 and 8.1.34

How to recognise a patched build: the version ends with pl-cwpsec, for example:
Code Select
/opt/alt/php-fpm74/usr/bin/php -v
PHP 7.4.33pl-cwpsec (cli) ...In the CWP admin panel (PHP Selector / PHP-FPM Selector) installed patched versions show a green secured label.

Your server has an older build without "pl-cwpsec"? Rebuild or reinstall that version once (PHP-FPM Selector, PHP Selector or PHP Switcher). Every new build of the versions above uses the patched sources automatically.

Note: the patch is a security mitigation, it does not make an end-of-life PHP "supported" again. As part of the fix, PHP session upload progress is disabled in these versions (upload progress bars stop working; uploads themselves work normally). Please plan the move to PHP 8.2+ where you can.


3. Ready-made PHP packages (RPMs) from the CWP repository

CWP now ships ready-made, tested PHP packages built with the default CWP build options. When you install a PHP version with the default options, the panel installs the package in a few seconds instead of compiling for 10-30 minutes:


Available versions:

The packages of the end-of-life versions (5.6 - 8.1) already contain the CWP security patch (pl-cwpsec).

Good to know:


4. New installations

The new CWP installer installs PHP from these packages as well. PHP-FPM versions can be added during the installation:
Code Select
cd /usr/local/src
curl -Lo cwp-latest http://centos-webpanel.com/cwp-latest
sh cwp-latest --phpfpm 7.4,8.3A complete installation takes about 3 minutes on AlmaLinux / Rocky 8 and 9 (about 10 minutes on CentOS 7). Full guide: https://control-webpanel.com/installation-instructions


Update your CWP to the latest version (sh /scripts/update_cwp or wait for the nightly update) to get all of this. If something does not work as expected, please reply here or open a ticket.

Changelog: https://control-webpanel.com/changelog

Regards,
CWP Team
Title: Re: Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages
Post by: overseer on October 30, 2026, 06:11:32 PM
Thank you very much for the clear communication -- it and your efforts are very much appreciated!
Title: Re: Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages
Post by: vox on October 30, 2026, 10:48:26 PM
I'm getting the following error when I try updating from the CWP dashboard "The module update does not exist." I guess I'll do it from the command line.
Text only | Text with Images