# changelog

author: Dan Muey <daniel.muey@webpros.com> - 2.4.64-3
changelog:
  - EA-13041: Rolling “ea-apache24” back to “35b37d6c7295199c5157c68145f220d9fa61ff02”: Apache v2.4.64 broke SNI (rando 421)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.66-1
changelog:
  - EA-13281: Update ea-apache24 from v2.4.65 to v2.4.66
  	- low: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  	- low: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)
  	- moderate: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVE-2025-59775)
  	- low: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  	- moderate: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-1
changelog:
  - EA-13423: Update ea-apache24 from v2.4.66 to v2.4.67
  	- important: Apache HTTP Server: http2: double free and possible RCE on early reset (CVE-2026-23918)
  	- moderate: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr (CVE-2026-24072)
  	- moderate: Apache HTTP Server: mod_auth_digest timing attack (CVE-2026-33006)
  	- low: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (CVE-2026-28780)
  	- low: Apache HTTP Server: mod_md unrestricted OCSP response (CVE-2026-29168)
  	- low: Apache HTTP Server: mod_dav_lock indirect lock crash (CVE-2026-29169)
  	- low: Apache HTTP Server: mod_authn_socache crash (CVE-2026-33007)
  	- low: Apache HTTP Server: multiple modules HTTP response splitting (CVE-2026-33523)
  	- low: Apache HTTP Server: off-by-one OOB reads in AJP getter functions (CVE-2026-33857)
  	- low: Apache HTTP Server: mod_proxy_ajp heap buffer over-read in ajp_msg_get_string (CVE-2026-34032)
  	- low: Apache HTTP Server: mod_proxy_ajp heap over-read in ajp_parse_data() (CVE-2026-34059)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-3
changelog:
  - EA-13454: Backport mod_http2 v2.0.41 fix for CVE-2026-49975 (HTTP/2 Bomb - cookie LimitRequestFields bypass)


author: Dan Muey <daniel.muey@webpros.com> - 6.1.0-3
changelog:
  - EA4-223: Move A10 host-flag-support from Apache to src ball (that way NGINX benefits from it too w/out duplicating efforts)


author: Nika Keshelava <nkeshelava@cloudlinux.com> - 1.0-46
changelog:
  - CLOS-3754: fix SIGSEGV in process_lve_error() when mod_brotli is loaded
  - CLOS-4441: Maintenance update
  - CLOS-4585: Maintenance update


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


changelog: - Initial MAx Cache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> 1.0.0-1


changelog: - Initial MaxCache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.1.0-1
changelog:
  - MAXWS-1043: Remove htcache-watchd dependency; use per-request stat() polling (RevalidateInterval=0)
  - MAXWS-1042: Rename MaxCacheHTCache* directives to MaxCacheHtaccess*; old names kept as deprecated aliases
  - MAXWS-1042: Rename htcache-status handler to maxcache-htaccess-status; old name kept as deprecated alias
  - MAXWS-1042: Rename config file maxcache_htcache.conf to maxcache_htaccess.conf with migration


author: Sergey Fokin <sfokin@cloudlinux.com> - 2:1.13.35.2-1.cloudlinux
changelog:
  - EA-13373: Fix version to match actual shipped binary (was 1.14.36.1 in spec
    but 1.13.35.2 in SOURCES RPM since EA-7761). Bump Epoch 2


author: Jared Wright <jared.wright@webpros.com> - 1.0-123
changelog:
  - EA4-249: Add target-os package rename mapping support to ea_current_to_profile
  - EA4-249: Add ignore_deps support to package rename mappings


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:3.0.15-1.cloudlinux
changelog:
  - EA-13435: Update ea-modsec30 from v3.0.14 to v3.0.15
  - EA-13435: Switch pcre-devel to pcre2-devel; ModSecurity 3.0.15 requires PCRE2


author: Cory McIntire <cory.mcintire@webpros.com> - 0.0.9beta1-16
changelog:
  - EA-13435: Fix libxml2.so.16 runtime load failure introduced by ea-modsec30 3.0.15 (new SONAME)
  - EA-13435: Use ea-libxml2 on el7/el8 (BuildRequires, Requires, conditional LDFLAGS)
  - EA-13435: Add pcre2-devel and lua-devel BuildRequires for modsec 3.0.15 transitive deps
  - EA-13435: Use patchelf in install to embed ea-libxml2 path in mod_security3.so RPATH (APR libtool ignores LDFLAGS at link time)
  - EA-13435: Add undefine brp_remove_rpath to preserve embedded RPATH


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.0.9beta1-16.cloudlinux
changelog:
  - EA-13435: Merge with cpanel 0.0.9beta1-16
  - EA-13435: Use ea-libxml2 on el7/el8, pcre2-devel, lua-devel for modsec 3.0.15
  - EA-13435: Add undefine brp_remove_rpath to preserve embedded RPATH
  - EA-13435: Exclude rhel >= 10 (ea-modsec30 not available)


author: Dan Muey <daniel.muey@webpros.com> - 1.29.1-1
changelog:
  - EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  - CVE-2025-53859: A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> alutsiuk <alutsiuk@cloudlinux.com> - 3:1.29.1-1.cloudlinux

changelog:
  - MAXWS-821: Fixed ea-nginx build after merge of nginx-1.29.1 version
  - MAXWS-793: Bump conflict version for max_webserver
  - MAXWS-756: Remove lsapi_check_script directive from cpanel-lsapi.conf
  - MAXWS-673: Implemented varmatch block based on precompiled action handlers


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.29.1-1.cloudlinux.1
changelog:
  - MAXWS-821: Evaluate varmatch block for access directives in the access phase
  - MAXWS-828: Added return and return_status_code directives support in varmatch block
  - MAXWS-849: Added remove_type directive support in nginx
  - MAXWS-851: Normalize varmatch regex with base= to match filenames
  - MAXWS-828: Fixed error_page usage in varmatch if defined in global context
  - MAXWS-861: Fixed regex normalization and matching under varmatch subdirs
  - MAXWS-889: Re-evaluate varmatch rules against the resolved index file URI


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.5-1
changelog:
  - EA-13333: Update ea-nginx from v1.29.4 to v1.29.5
  - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.7-1
changelog:
  - EA-13381: Update ea-nginx from v1.29.6 to v1.29.7
  - Security: buffer overflow in COPY or MOVE request handling with "alias" directive (CVE-2026-27654).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module on 32-bit platforms might cause a worker process crash (CVE-2026-27784).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module might cause a worker process crash (CVE-2026-32647).
  - Security: segmentation fault in worker process with CRAM-MD5 or APOP authentication when retry enabled (CVE-2026-27651).
  - Security: PTR DNS record injection in auth_http requests and XCLIENT command (CVE-2026-28753).
  - Security: SSL handshake succeeds despite OCSP rejecting client certificate in stream module (CVE-2026-28755).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.0-1
changelog:
  - EA-13436: Update ea-nginx from v1.30.0 to v1.31.0
  - Security: heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.1-1
changelog:
  - EA-13448: Update ea-nginx from v1.31.0 to v1.31.1
  - Security: remote code execution via worker process memory pool handling (CVE-2026-9256).


author: EA4 Update Bot <cory.mcintire@webpros.com> - 1.31.3-1
changelog:
  - EA-13503: Update ea-nginx from v1.31.2 to v1.31.3
  - Security: heap buffer overflow when using map with regex, potentially allowing remote code execution or worker process denial of service via a crafted HTTP request (CVE-2026-42533).
  - Security: memory disclosure when using the ngx_http_slice_module (CVE-2026-60005).
  - Security: use-after-free when using the ngx_http_ssi_module (CVE-2026-56434).


author: CloudLinux <packages@cloudlinux.com> - 0.64-7
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.64-7
  - EA-13411: Build against ea-nginx version v1.30.0


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.65-1.cloudlinux.1
changelog:
  - EA-13468: Use %{version} for Source0/setup; drop stale module_version macro (fixes v0.64.tar.gz not found)


author: CloudLinux <packages@cloudlinux.com> - 0.39-9
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.39-9
  - EA-13411: Build against ea-nginx version v1.30.0


author: CloudLinux <packages@cloudlinux.com> - 0.9.6-5
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.9.6-5
  - EA-13411: Build against ea-nginx version v1.30.0


author: CloudLinux <packages@cloudlinux.com> - 6.1.2-6
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 6.1.2-6
  - EA-13411: Build against ea-nginx version v1.30.0


author: Cory McIntire <cory.mcintire@webpros.com> - 6.0.26-1
changelog:
  - EA-12725: Update ea-passenger-src from v6.0.25 to v6.0.26
    * [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.


author: Dan Muey <daniel.muey@webpros.com> - 6.1.0-2
changelog:
  - EA4-223: Move A10 host-flag-support from Apache module that uses this src ball (that way NGINX benefits form it too w/out duplicating efforts)


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 1:5.6.40-25.cloudlinux.3
changelog:
  - EA4D-746: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-25.cloudlinux.10
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp5.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:5.6.40-25.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php56
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:3.3-8.cloudlinux.4
changelog:
  - Stop bundling opcache.so for PHP 5.5/5.6 to allow coexistence with php-opcache
  - Remove Conflicts with php-opcache (no longer needed without bundled opcache.so)
  - Strip invalid RPATH from ZendGuardLoader.so
  - Exclude ea-php55 and older zendguard builds on RHEL >= 9 (no devel packages available)


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-29.cloudlinux.9
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.0.33-29.cloudlinux.13
changelog:
  - ELS-2599: Sync CVE patches from alt-php70
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.1.33-20.cloudlinux.13
changelog:
  - ELS-2599: Sync CVE patches from alt-php71
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 7.2.34-12.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.2.34-12.cloudlinux.11
changelog:
  - ALTPHP-2422: Disable OPcache SCCP pass (bit 0x80) in default optimization_level
    to avoid runtime infinite loop caused by SCCP+DFA miscompilation
    (e.g. WordPress wp_replace_in_html_tags on CloudLinux 10 + cPanel)


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.2.34-12.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php72
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.3.33-15.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)
  - CVE-2025-1736: fix for PHP SOAP extension


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:7.3.33-15.cloudlinux.12
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated DEB LiteSpeed SAPI source to 8.3


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.3.33-15.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php73
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18.cloudlinux.6
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-808: fix Provides field in debian/control to use exact versions
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.4.33-18.cloudlinux.10
changelog:
  - ELS-2599: Sync CVE patches from alt-php74
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7.4.33-13.cloudlinux.5
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range calculation


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.0.30-9.cloudlinux.4
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-5458: filter_var URL validation fix
  - CVE-2024-8925: multipart form data parsing fix
  - CVE-2024-8927: cgi.force_redirect configuration bypass
  - CVE-2024-9026: error log parsing fix
  - CVE-2025-14178: integer overflow in array_merge


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:8.0.30-9.cloudlinux.8
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated LiteSpeed SAPI source to 8.3


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:8.0.30-9.cloudlinux.10
changelog:
  - ELS-2599: Sync CVE patches from alt-php80
  - CVE-2025-14179, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 8.0.30-8.cloudlinux.3
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 8.0.30-8.cloudlinux.4
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range
    calculation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-8.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.32-1
changelog:
  - EA-12766: Update ea-php81 from v8.1.31 to v8.1.32
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.33-1
changelog:
  - EA-13001: Update ea-php81 from v8.1.32 to v8.1.33
  	- Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)
  	- Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  	- Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.1.34-1.cloudlinux
changelog:
  - EA4D-789: Update ea-php81 from v8.1.33 to v8.1.34
  - Fixed CVE-2025-14177
  - Fixed CVE-2025-14178: integer overflow in array_merge
  - Fixed CVE-2025-14180
  - EA4D-793: Update php-fpm LVE patch


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:8.1.34-1.cloudlinux.7
changelog:
  - ELS-2599: Sync CVE patches from alt-php81
  - CVE-2025-14179, CVE-2026-14355, CVE-2026-6722, CVE-2026-6735,
    CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568


author: Cory McIntire <cory@cpanel.net> - 8.2.26-1
changelog:
  - EA-12577: Update ea-php82 from v8.2.25 to v8.2.26
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.28-1
changelog:
  - EA-12772: Update ea-php82 from v8.2.27 to v8.2.28
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.29-1
changelog:
  - EA-12996: Update ea-php82 from v8.2.28 to v8.2.29
  - Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220)
  - Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491)
  - Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.2.30-1.cloudlinux
changelog:
  - EA4D-789: Update ea-php82 from v8.2.29 to v8.2.30
  - Fixed CVE-2025-14177
  - Fixed CVE-2025-14178: integer overflow in array_merge
  - Fixed CVE-2025-14180
  - EA4D-793: Update php-fpm LVE patch


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.2.31-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php82 from v8.2.30 to v8.2.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.31-1
changelog:
  - EA-13427: Update ea-php82 from v8.2.30 to v8.2.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.2.32-1
changelog:
  - EA-13482: Update ea-php82 from v8.2.31 to v8.2.32
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 8.3.29-1
changelog:
  - EA-13295: Update ea-php83 from v8.3.28 to v8.3.29
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Ilya Voyskovsky <ivoyskovsky@@cloudlinux.com> - 8.3.30-1.cloudlinux.5
changelog:
  - EA4D-806: Fix litespeed patches
  - ALTPHP-2369: Add LVD (Light Virtual Domain) support to fpm patches


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.3.31-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php83 from v8.3.30 to v8.3.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.3.31-1
changelog:
  - EA-13428: Update ea-php83 from v8.3.30 to v8.3.31
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.3.32-1
changelog:
  - EA-13483: Update ea-php83 from v8.3.31 to v8.3.32
  - Fixed bug GH-21468 (TLS setup failure leading to remote DoS). (CVE-2026-12184)
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.4.19-1
changelog:
  - EA-13372: Update ea-php84 from v8.4.18 to v8.4.19
  - EA4D-797: revert to use system libxml2 lib fro all platforms


author: Dan Muey <daniel.muey@webpros.com> - 8.4.16-1
changelog:
  - EA-13296: Update ea-php84 from v8.4.15 to v8.4.16
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.4.21-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php84 from v8.4.20 to v8.4.21
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.4.21-1
changelog:
  - EA-13429: Update ea-php84 from v8.4.20 to v8.4.21
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:8.4.21-3.cloudlinux
changelog:
  - ALTPHP-2446: Fix lsphp SIGSEGV in LSAPI .user.ini home-dir scan (uninitialized ctx->user_home use-before-init in Patch911)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.4.23-1
changelog:
  - EA-13484: Update ea-php84 from v8.4.22 to v8.4.23
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Dan Muey <daniel.muey@webpros.com> - 8.5.1-1
changelog:
  - EA-13294: Update ea-php85 from v8.5.0 to v8.5.1
  - Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
  - Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
  - Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.5.4-1
changelog:
  - EA-13374: Update ea-php85 from v8.5.3 to v8.5.4
  - EA4D-797: revert to use system libxml2 lib fro all platforms


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:8.5.6-1.cloudlinux
changelog:
  - EA4D-837: Update ea-php85 from v8.5.5 to v8.5.6
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.5.6-1
changelog:
  - EA-13430: Update ea-php85 from v8.5.5 to v8.5.6
  - Fixed GHSA-7qg2-v9fj-4mwv (XSS within FPM status endpoint). (CVE-2026-6735)
  - Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in mb_ereg_search_init()). (CVE-2026-7259)
  - Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in PDO_Firebird). (CVE-2025-14179)
  - Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL ref_map pointer). (CVE-2026-6722)
  - Fixed GHSA-m33r-qmcv-p97q (Use-after-free in SOAP persistence session). (CVE-2026-7261)
  - Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check in SOAP). (CVE-2026-7262)
  - Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  - Fixed GHSA-m8rr-4c36-8gq4 (Unsigned char handling in ctype.h functions). (CVE-2026-7258)


author: EA4 Update Bot <cory.mcintire@webpros.com> - 8.5.8-1
changelog:
  - EA-13485: Update ea-php85 from v8.5.7 to v8.5.8
  - Fixed bug GH-22187 (Memory corruption in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.0-63
changelog:
  - ZC-11253: Update EA4 profiles - Add ea-php82, Remove ea-php80
  - EA4D-444: remove ea-php74-php-snuffleupagus from profiles


author: Dan Muey <dan@cpanel.net> - 1.0-67
changelog:
  - ZC-11494: Rolling “ea-profiles-cpanel” back to “562229d”: scriptlets seem to be happening out of order on a9


author: Dan Muey <daniel.muey@webpros.com> - 4:1.0-74
changelog:
  - EA4-204: Update “allphp allphp-opcache default default-nginx mpm_itk worker”
    profile(s):  add “ea-php83” based on “ea-php81”


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 4:1.0-75.cloudlinux.1
changelog:
  - EA4D-845: Extend ea-php80/83/84/85 coverage across all CL10 profiles
    (allphp, allphp-opcache, allphp_lsapi, allphp-opcache_lsapi, default,
    default_lsapi, default-nginx, default_passenger, worker — both clshared
    and clsolo). Brings CL10 to parity with CL9 which already covers all
    modern PHP versions. ea-php84/85 omit php-imap and php-pspell since
    upstream PHP no longer ships them; ea-php85 also omits php-opcache
    (not built for 8.5 on CL10).


