Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages

[Administrator]

Secure PHP versions in CWP: security-patched EOL PHP and ready-made PHP packages

Hello everyone,

Here is an overview of the PHP security work in the latest CWP releases (1.27 / 1.28): which PHP versions are safe to use, which older versions we patch ourselves, and the new ready-made PHP packages that install in seconds instead of compiling.


1. Supported PHP versions (recommended)

These PHP branches still receive official security fixes. CWP always builds the newest release of each branch:

PHP	Version in CWP
8.2	8.2.35
8.3	8.3.36 (default PHP for websites and the panel)
8.4	8.4.27
8.5	8.5.12

If your sites can run on PHP 8.2 or newer, use one of these.


2. Older (end-of-life) PHP versions with the CWP security patch

Many sites still need older PHP. These versions no longer get fixes from php.net, so CWP builds them from its own sources with a security backport for the PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619):

PHP	Patched version
5.4	5.4.45
5.5	5.5.38
5.6	5.6.40
7.0	7.0.33
7.1	7.1.33
7.2	7.2.34
7.3	7.3.33
7.4	7.4.33
8.0	8.0.30
8.1	8.1.31 and 8.1.34

How to recognise a patched build: the version ends with pl-cwpsec, for example:

Code Select Expand

/opt/alt/php-fpm74/usr/bin/php -v
PHP 7.4.33pl-cwpsec (cli) ...In the CWP admin panel (PHP Selector / PHP-FPM Selector) installed patched versions show a green secured label.

Your server has an older build without "pl-cwpsec"? Rebuild or reinstall that version once (PHP-FPM Selector, PHP Selector or PHP Switcher). Every new build of the versions above uses the patched sources automatically.

Note: the patch is a security mitigation, it does not make an end-of-life PHP "supported" again. As part of the fix, PHP session upload progress is disabled in these versions (upload progress bars stop working; uploads themselves work normally). Please plan the move to PHP 8.2+ where you can.


3. Ready-made PHP packages (RPMs) from the CWP repository

CWP now ships ready-made, tested PHP packages built with the default CWP build options. When you install a PHP version with the default options, the panel installs the package in a few seconds instead of compiling for 10-30 minutes:

• cwp-php-fpmNN - PHP-FPM Selector versions (/opt/alt/php-fpmNN)
• cwp-php-cgiNN - PHP Selector (CGI) versions (/opt/alt/phpNN)
• cwp-php-switcherNN - PHP Switcher version (/usr/local, the default PHP for websites)

Available versions:

• CentOS 7 / AlmaLinux 8 / Rocky 8 (EL7, EL8): PHP 5.6 - 8.5
• AlmaLinux 9 / Rocky 9 (EL9): PHP 7.4 - 8.5

The packages of the end-of-life versions (5.6 - 8.1) already contain the CWP security patch (pl-cwpsec).

Good to know:

• Your php.ini, php-fpm.conf and extra php.d settings are kept when a package is installed or updated.
• If you choose your own build options, CWP compiles from source exactly as before. If a package is not available, it also falls back to compiling.
• A normal "yum update" / "dnf update" never changes your PHP version on its own.
• The nightly PHP auto-update uses the packages too.
• PHP 8.3, 8.4 and 8.5 built with the ionCube option now get the matching ionCube loader. If ionCube was missing after a build, rebuild or reinstall the version once.

4. New installations

The new CWP installer installs PHP from these packages as well. PHP-FPM versions can be added during the installation:

Code Select Expand

cd /usr/local/src
curl -Lo cwp-latest http://centos-webpanel.com/cwp-latest
sh cwp-latest --phpfpm 7.4,8.3A complete installation takes about 3 minutes on AlmaLinux / Rocky 8 and 9 (about 10 minutes on CentOS 7). Full guide: https://control-webpanel.com/installation-instructions


Update your CWP to the latest version (sh /scripts/update_cwp or wait for the nightly update) to get all of this. If something does not work as expected, please reply here or open a ticket.

Changelog: https://control-webpanel.com/changelog

Regards,
CWP Team

[overseer]

Thank you very much for the clear communication -- it and your efforts are very much appreciated!

[vox]

I'm getting the following error when I try updating from the CWP dashboard "The module update does not exist." I guess I'll do it from the command line.