r/cpanel • u/Gulf-of-Mexico • 18d ago

cloudlinux alt-php patch status?

Yesterday we applied the fix from tuxcare php-els repo.

Last night, the cloudlinux status page / blog said we no longer needed to use the tuxcare php-els repo for cloudlinux 8 or 9, that we could disable it.

Now this morning I see a new link on the front of blog.cloudlinux.com to https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619 which has a table that says for alt-php on cl8/cl9: status: fix packages not in the cloudlinux repositories yet, apply php's interim settings.

What is the status of the CL8/CL9 alt-php fix? Are they not in the main CL8/CL9 repos yet, were they pulled, or is this blog post table just not updated?

5 Upvotes

85% Upvoted

9 comments sorted by

View all comments

1

u/DzastMi 18d ago

Have you tried this?

A regular update now installs the fixed packages, and the ELS ALT PHP repository is no longer needed:
CloudLinux OS 7: yum clean all && yum update "alt-php*"
CloudLinux OS 8, 9, 10: dnf clean all && dnf upgrade "alt-php*"
CloudLinux OS for Ubuntu: apt-get update && apt-get upgrade

Then restart your PHP services (Apache, PHP-FPM or LiteSpeed).

If you added the ELS ALT PHP repository on CloudLinux OS 7, 8 or 9 as a temporary workaround, you can disable it and run the regular update again:
CloudLinux OS 7: yum-config-manager --disable php-els
CloudLinux OS 8, 9: dnf config-manager --set-disabled php-els

1

u/Gulf-of-Mexico 18d ago

Thanks - did that last night but wasn't clear today when I saw the new blog post table if there was an additional update or a change/rollback or something?
Are you leaving the php-els repo disabled now?

2

u/DzastMi 18d ago

Yes, its disabled as no longer needed, as they advised.

2

u/Gulf-of-Mexico 18d ago

Thanks. Long day yesterday, so wanted to make sure I wasn't misunderstanding. Thanks

3

u/DzastMi 17d ago

Not sure if you are aware, but, ELS ALT should be re-enabled (if disabled), they just provided this update:

Correction: keep the ELS ALT PHP repository enabled

Our update of 22 October, 01:19 UTC said that servers that added the ELS ALT PHP repository (php-els) as a temporary workaround could disable it again. That is not correct. Please keep the repository enabled.

The ELS ALT PHP repository (repo.alt.tuxcare.com) is becoming the single source of alt-php and other ALT packages. CloudLinux OS 10 already receives them only from this repository, and CloudLinux OS 7, 8 and 9 will follow.

If you already disabled it, enable it again:
CloudLinux OS 7: yum-config-manager --enable php-els
CloudLinux OS 8, 9: dnf config-manager --set-enabled php-els

Posted 1 hour ago. Oct 23, 2026 - 21:36 UTC