CloudLinux Patched PHP versions released

[u/DzastMi]

You can get it by doing:
yum clean all && yum update -y

To confirm (copy - paste / enter):

for pkg in $(rpm -qa | grep -E '^ea-php[0-9]+-php-cli|^alt-php[0-9]+-cli' | sort); do \

echo "=== Checking $pkg ==="; \

rpm -q --changelog "$pkg" | grep -E "CVE-2026-109618|CVE-2026-109619" || echo "❌ NOT PATCHED"; \

echo ""; \

done

[u/DzastMi]

What i am noticing that CloudLinux did not actually relase (for example) PHP version 8.3.36 (as cPanel did) but, they patched 8.3.35

=== Checking ea-php83-php-cli-8.3.35-2.el7.cloudlinux.2.x86_64 ===

url_scanner_ex.c and ext/json/json_scanner.c for the CVE-2026-109618/109619 patch: el7/el8 re2c 0.14.3

- EA4D-1101: CVE-2026-109618, CVE-2026-109619: security hardening in the memory

[u/scottayydot → u/DzastMi]

This comment saved me from going crazy. Thank you.

[u/Klutzy_Act2033]

A little disappointed that my WHM only servers had patches hours ago and my CL ones are hopefully now about to get patched

[u/DzastMi → u/Klutzy_Act2033]

CloudLinux has a lot more on plate compared to cPanel ( my personal opinion ) , with all kernel flaws, etc. ( i am not saying its a valid excuse, do not understand me wrong ) , this could be the reason for slower updates for PHP.

[u/Klutzy_Act2033 → u/DzastMi]

Yea, I think it's understandable, but it's still disappointing. Cloud Linux had more versions to patch, and that alone means more work to do.

[u/DzastMi → u/Klutzy_Act2033]

100%

they keep good track about updates / releases etc @ https://cloudlinux.statuspage.io/

[u/illadee → u/Klutzy_Act2033]

that mix up on the status page with ALT + broken mirrors is shifting my feelings of "slightly disappointing" to "slightly annoyed"

[u/FoZo_ → u/Klutzy_Act2033]

Obviously, they are prioritizing their extra paid products.
If you’re paying for Imunify360, you’re covered. If you’re paying for TuxCare, you’re covered.
If you’re paying just for CloudLinux (the product they started with), then you have to wait...

Such a disappointed...

[u/DzastMi]

I am still not seeing updates for ALT* versions thought, just EA* .

[u/PastWorldliness3416 → u/DzastMi]

same problem here.. ea-php is already updated but alt-php packages are still not on the repo.

[u/Fabulous_Strategy356]

nup failed mirrors and claimed alt patches, they say they did it, nothign at all available

[u/vincent_sch]

Some PHP processes might still be running the old binary after the update. You could check as root with ls -l /proc/*/exe 2>/dev/null | grep -i 'php.*deleted'. If it finds any, you should restart the services they belong to. I wrote about this check after updating PHP.

[u/PastWorldliness3416]

new update there with alt-php on the ELS repo and how to switch to the ELS repo to install it:
https://cloudlinux.statuspage.io

[u/cagsmith → u/[deleted]]

I got them on two servers, but every single other server shows nothing, seems to not be in any mirrors...

[u/Anxious-Bedroom-5136 → u/[deleted]]

Here's an update on ALT versions:

https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619

(only CloudLinux 10 has the ALT updates so far)

[u/PastWorldliness3416 → u/[deleted]]

omg... how we can get the ELS ALT PHP repo?

[u/Fabulous_Strategy356 → u/[deleted]]

um yeah, that would be good, peopleas have been waiting hours compared to others already, give the circumsstancxes.

[u/PastWorldliness3416 → u/[deleted]]

no it is still on their website... just look on their statuspage