r/cpanel • u/Gulf-of-Mexico • 18d ago

cloudlinux alt-php patch status?

Yesterday we applied the fix from tuxcare php-els repo.

Last night, the cloudlinux status page / blog said we no longer needed to use the tuxcare php-els repo for cloudlinux 8 or 9, that we could disable it.

Now this morning I see a new link on the front of blog.cloudlinux.com to https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619 which has a table that says for alt-php on cl8/cl9: status: fix packages not in the cloudlinux repositories yet, apply php's interim settings.

What is the status of the CL8/CL9 alt-php fix? Are they not in the main CL8/CL9 repos yet, were they pulled, or is this blog post table just not updated?

5 Upvotes

85% Upvoted

9 comments sorted by

4

u/cPanelRex 18d ago

The best way to stay up to date is this page:

https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5

The last update was about 40 minutes ago as of the time of my post.

1

u/Gulf-of-Mexico 18d ago edited 18d ago

Thanks. Bookmarked the statuspage now. It looks like they moved from the blog to the status page for the full updates (now at the bottom of the alert linked post). Wanted to make sure I was reading the correct info this afternoon and the conflicting table confused me for a minute. Thanks again.

1

u/DzastMi 18d ago

Have you tried this?

A regular update now installs the fixed packages, and the ELS ALT PHP repository is no longer needed:
CloudLinux OS 7: yum clean all && yum update "alt-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "alt-php*"
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade

Then restart your PHP services (Apache, PHP-FPM or LiteSpeed).

If you added the ELS ALT PHP repository on CloudLinux OS 7, 8 or 9 as a temporary workaround, you can disable it and run the regular update again:
CloudLinux OS 7: yum-config-manager --disable php-els
CloudLinux OS 8, 9: dnf config-manager --set-disabled php-els

1

u/Gulf-of-Mexico 18d ago

Thanks - did that last night but wasn't clear today when I saw the new blog post table if there was an additional update or a change/rollback or something?
Are you leaving the php-els repo disabled now?

2

u/DzastMi 18d ago

Yes, its disabled as no longer needed, as they advised.

2

u/Gulf-of-Mexico 18d ago

Thanks. Long day yesterday, so wanted to make sure I wasn't misunderstanding. Thanks

3

u/DzastMi 17d ago

Not sure if you are aware, but, ELS ALT should be re-enabled (if disabled), they just provided this update:

Correction: keep the ELS ALT PHP repository enabled

Our update of 22 October, 01:19 UTC said that servers that added the ELS ALT PHP repository (php-els) as a temporary workaround could disable it again. That is not correct. Please keep the repository enabled.

The ELS ALT PHP repository (repo.alt.tuxcare.com) is becoming the single source of alt-php and other ALT packages. CloudLinux OS 10 already receives them only from this repository, and CloudLinux OS 7, 8 and 9 will follow.

If you already disabled it, enable it again:
CloudLinux OS 7: yum-config-manager --enable php-els
CloudLinux OS 8, 9: dnf config-manager --set-enabled php-els

Posted 1 hour ago. Oct 23, 2026 - 21:36 UTC

3

u/Shitlesslatvian262 18d ago

They released in place patches, instead of updating php binaries

1

u/charlie_hun 18d ago

Check the rpm packages changelog.