Is PHP2Shell fixed on cPanel EasyApache 4 (ea-php)?

Status as of October 26, 2026: Partly confirmed: some builds are confirmed in two primary sources, others aren’t yet.

The short answer

cPanel EasyApache 4 (ea-php) ships fixed PHP packages for PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Confirmed in two primary sources: ea-php74 to ea-php85: Fixed in EasyApache 4 25.91 (Oct 21, 2026) (cPanel release notes; CloudLinux advisory). Stated in one source only, so not confirmed as of October 26, 2026: ea-php52 to ea-php73: Fixed builds listed by CloudLinux (e.g. ea-php73 7.3.33-15); Build strings for ea-php74 to ea-php85: ea-php74 7.4.33-18, ea-php80 8.0.30-11, ea-php81 8.1.34-4; ea-php82 8.2.35-1, ea-php83 8.3.36-1, ea-php84 8.4.27-1, ea-php85 8.5.12-1 (Oct 23). Earlier backport builds, e.g. ea-php84 8.4.26-2, also carry the fix; cPanel & WHM’s own internal PHP: PHP 8.4.27 in cPanel & WHM 138.0.18, 136.0.50 and 134.0.66; backported fixes for PHP 8.1.34 in 110.0.153. A fixed package only counts once it’s installed and PHP has restarted (source: AlmaLinux). A related flaw, CVE-2026-115560, has no fix in any PHP release as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).

Fix status on cPanel ea-php

How to check on cPanel ea-php (read-only)

Run these on the server. They only read package data, the process list and configuration files.

# 1. Installed ea-php packages and their versions
rpm -qa 'ea-php*' --qf '%{NAME} %{VERSION}-%{RELEASE}\n' | sort

# 2. Does the changelog name both CVEs? (CloudLinux's check.) Replace XY with each version you use, e.g. 84 for PHP 8.4
rpm -q --changelog ea-phpXY-php-cli | grep -E 'CVE-2026-(109618|109619)'
# No match doesn't mean unpatched: compare the installed version with the fixed build above

# 3. cPanel & WHM's own version (its internal PHP is separate from ea-php)
/usr/local/cpanel/cpanel -V

# 4. When did each PHP-FPM master start? It must be after the update
ps -eo pid,lstart,args | grep '[p]hp-fpm: master'

# 5. CVE-2026-115560: is the setting in the configuration files?
grep -rns 'session.upload_progress.enabled' /opt/cpanel/ea-phpXY/root/etc/   # repeat for each version, XY as above

Check the PHP that serves your website, not just the command line: they can be different builds (source: AlmaLinux). The five checks that count as proof.

CVE-2026-115560

On October 23, 2026, PHP disclosed a related flaw, CVE-2026-115560, that the October 21 releases don’t fix. Until its next regular bugfix release, PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP. Setting it from application code (ini_set()) or a per-directory .user.ini file doesn’t count (source: php.net advisory on CVE-2026-115560, October 23, 2026).

On cPanel ea-php: cPanel’s release notes don’t mention CVE-2026-115560 in the parts we read. CloudLinux gives session.upload_progress.enabled=0 in php.ini or the PHP-FPM pool, then a restart, as an interim setting. (CloudLinux)

Notes for cPanel ea-php

• CloudLinux warns that backports keep old version numbers: an ea-php84 showing 8.4.26-2 carried the fix before 8.4.27-1 shipped. Check the changelog for the CVE IDs (source: AlmaLinux).

Sources (checked October 26, 2026)

• cPanel: cPanel release notes (EasyApache 4 25.91, 25.92; cPanel & WHM security update). Page date: EA4 25.91 and 25.92 dated Oct 21, 2026; page last modified Oct 22, 2026. States: EA4 25.91 fixes both CVEs in ea-php74 through ea-php85; 25.92 rebuilds ea-php74, ea-php80, ea-php81 meta packages so their change log lists the backport; cPanel & WHM 138.0.18, 136.0.50, 134.0.66 include PHP 8.4.27; 110.0.153 has backported fixes for PHP 8.1.34.
• CloudLinux: PHP CVE-2026-109618 and CVE-2026-109619. Page date: Oct 21, 2026; main text updated Oct 23, 2026 08:40 UTC; status entries to Oct 23, 2026 21:36 UTC. States: ea-php52 to ea-php85 and alt-php fixed builds in stable; ea-php82–85 and alt-php82–85 on PHP.net numbers (Oct 23 13:10); earlier backports keep lower version numbers; verify with rpm -q –changelog | grep the CVE IDs; security metadata not yet published, use a regular update; session.upload_progress.enabled=0 interim setting. Oct 23 21:36 UTC correction: keep the ELS ALT PHP repository (repo.alt.tuxcare.com) enabled; it is becoming the single source of alt-php; CloudLinux OS 10 already gets alt-php only from it, 7, 8 and 9 will follow. The main text still has the older advice.

Upstream facts (fixed releases, CVE-2026-115560, end-of-life dates) are footnoted to /sources. We list a build as confirmed only when two different primary documents state it. Method.

Related

CloudLinux alt-php · Plesk (Linux) · All platforms · How to prove your server is patched · What to ask your host or developer

Want it checked for you?

• Patch Verification & Compromise Review. Collection is read-only, and we change nothing on your server. You get a plain-English report: where each fix stands, as of a stated time, plus a compromise review from October 17, signed by the Approver of Record. Ask for it
• Check it yourself, free. The read-only steps are on our PHP2Shell page. Our open-source self-check script is publishing soon.