[CLSA-2026:1788345547] Fix of 14 CVEs
Type:
security
Severity:
Critical
Release date:
2026-09-02 10:39:40 UTC
Description:
* ALTEAPLN-3: no change to the Debian packaging - alt-php74-cli has never depended on the FPM package here. Recorded for parity with the RPM side, where a hard Requires was dropped so the FPM package can be removed on servers that only use PHP Selector via lsapi * ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php74/root/etc/php-fpm.d/_.conf placeholder in the package. cPanel counts any *.conf in that directory as an enabled FPM pool and kept restarting alt-php74-fpm through chkservd on servers that never use FPM, even with the unit disabled. The alt-php74-php-fpm post-install script now creates the file with mode 0644 only when cPanel is absent - the only case where it is wanted, to silence php-fpm's include-glob warning - and deletes it when cPanel is present. Since no package owns the file any more, a new -php-fpm postrm removes it on remove and purge, so a stray *.conf cannot be left behind to re-trigger this bug if cPanel is installed later The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
Updated packages:
  • alt-php74_7.4.33-72_amd64.deb
    sha:043ae7c5d3d8f0b5b83403b7a704fcf6d00555e5
  • alt-php74-bcmath_7.4.33-72_amd64.deb
    sha:51cdb2c6d7f090855b6ef265fc7aadd561252ea1
  • alt-php74-cli_7.4.33-72_amd64.deb
    sha:f02f37b860760b2fc78e50cab7bdd2f6ed89af9d
  • alt-php74-common_7.4.33-72_amd64.deb
    sha:07ec2e57763e52481b81cf24103e0be9bd78421c
  • alt-php74-dba_7.4.33-72_amd64.deb
    sha:5cee7c675fdbea3f4f4268f94309dd32e7956483
  • alt-php74-dev_7.4.33-72_amd64.deb
    sha:797ecfe14c4410a261ad8b89d78feb44edfb8e3d
  • alt-php74-enchant_7.4.33-72_amd64.deb
    sha:88e4c104b7e5d3f250952b8e984edeccf9245c95
  • alt-php74-firebird_7.4.33-72_amd64.deb
    sha:447e574930a3d74afb3f91ae0f06836356926ebb
  • alt-php74-gd_7.4.33-72_amd64.deb
    sha:a147a873c3b49b232e381a7da801844a5b2a4c4c
  • alt-php74-imap_7.4.33-72_amd64.deb
    sha:427e2a4c79c7eed78ca5a14d31ea61aadcd80fc0
  • alt-php74-intl_7.4.33-72_amd64.deb
    sha:e00aad8c888ae8db28232b2ec509946f0fef0c9b
  • alt-php74-ldap_7.4.33-72_amd64.deb
    sha:4a520058a4d38ff538414ec24f6f67dfb29c0876
  • alt-php74-mbstring_7.4.33-72_amd64.deb
    sha:c7ab50823fe243a6241b87a953d32394af559d92
  • alt-php74-mysqlnd_7.4.33-72_amd64.deb
    sha:a8577a1c3186fa5ca8419cc264b6f44d8c7737b5
  • alt-php74-odbc_7.4.33-72_amd64.deb
    sha:b515a122d356f1f67d7306bab8b8362ccc84dfe2
  • alt-php74-opcache_7.4.33-72_amd64.deb
    sha:0291693859e046f700e8f42ff74fc94834430c7b
  • alt-php74-pdo_7.4.33-72_amd64.deb
    sha:5ae26fa698adbfeea41386d09f4082b755cfa0c5
  • alt-php74-pgsql_7.4.33-72_amd64.deb
    sha:ac4f0e6a8fb3283558c218e9c624a4bf4419f31b
  • alt-php74-php-fpm_7.4.33-72_amd64.deb
    sha:78e846e75a7171f197c1c98980f956751198aafc
  • alt-php74-process_7.4.33-72_amd64.deb
    sha:41d2d69c3bdb3d9540eca0e9302294d0f4386a86
  • alt-php74-pspell_7.4.33-72_amd64.deb
    sha:3653c3e722c3c1249d9f988ef05f3adf7779921d
  • alt-php74-snmp_7.4.33-72_amd64.deb
    sha:ab8ff671a6bdb2bbce92d313d1c60f6f85d32c78
  • alt-php74-soap_7.4.33-72_amd64.deb
    sha:282ab1df1ccc453eb7f5e3355a649a90959958ed
  • alt-php74-sodium_7.4.33-72_amd64.deb
    sha:bbfe3fc0a8d9de351f615d9476c3aa06d9a41673
  • alt-php74-tidy_7.4.33-72_amd64.deb
    sha:95f69c59f0977c2efa0cde1e7ba493796e89a75a
  • alt-php74-xml_7.4.33-72_amd64.deb
    sha:3a46aad199a22ed6eef738f8d72f434529656c5d
  • alt-php74-xmlrpc_7.4.33-72_amd64.deb
    sha:6f0f00c08a2e11d087485d7807febaee7494f682
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.