[CLSA-2026:1788346507] Fix of 13 CVEs
Type:
security
Severity:
Critical
Release date:
2026-09-02 10:55:38 UTC
Description:
* ALTEAPLN-3: no change to the Debian packaging - alt-php80-cli has never depended on the FPM package here. Recorded for parity with the RPM side, where a hard Requires was dropped so the FPM package can be removed on servers that only use PHP Selector via lsapi * ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php80/root/etc/php-fpm.d/_.conf placeholder in the package. cPanel counts any *.conf in that directory as an enabled FPM pool and kept restarting alt-php80-fpm through chkservd on servers that never use FPM, even with the unit disabled. The alt-php80-php-fpm post-install script now creates the file with mode 0644 only when cPanel is absent - the only case where it is wanted, to silence php-fpm's include-glob warning - and deletes it when cPanel is present. Since no package owns the file any more, a new -php-fpm postrm removes it on remove and purge, so a stray *.conf cannot be left behind to re-trigger this bug if cPanel is installed later The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
Updated packages:
  • alt-php80_8.0.30-61_amd64.deb
    sha:dfaa71c97de2442f6504bfebc0755a387c26414e
  • alt-php80-bcmath_8.0.30-61_amd64.deb
    sha:254fa1477bc2c19d5916ac30dd38ec6a03797ba2
  • alt-php80-cli_8.0.30-61_amd64.deb
    sha:3d7062270acf3589c2f64242916e8b4c141fee2a
  • alt-php80-common_8.0.30-61_amd64.deb
    sha:138708c2f2a4a2128f8432910445c55621a137a6
  • alt-php80-dba_8.0.30-61_amd64.deb
    sha:88d11085f5c5d8c31fa5811955624198716537c1
  • alt-php80-dev_8.0.30-61_amd64.deb
    sha:15839a575c37389ad8bda596d7b4d9c2c5612e25
  • alt-php80-enchant_8.0.30-61_amd64.deb
    sha:969ce9f200048b757a69df31633a4b25a04ea813
  • alt-php80-firebird_8.0.30-61_amd64.deb
    sha:dc69eb6572e2770d0d2850380db7c15d55ac8506
  • alt-php80-gd_8.0.30-61_amd64.deb
    sha:9d007cf31d9e79d393ad83f4f3b2ef7a92c2c291
  • alt-php80-imap_8.0.30-61_amd64.deb
    sha:c05a1e1aa94302c31b2e719ae38068c8b8ce4d7a
  • alt-php80-intl_8.0.30-61_amd64.deb
    sha:3a687636e27c97cdac7ba9a88fdd75f48c067381
  • alt-php80-ldap_8.0.30-61_amd64.deb
    sha:b038c1c4d96fc1902387377b21763158f5ac6841
  • alt-php80-mbstring_8.0.30-61_amd64.deb
    sha:439b6965ac0c0c51c9bcaaef82d65e3f79700969
  • alt-php80-mysqlnd_8.0.30-61_amd64.deb
    sha:91b1b7f17172a776318d4bd677135342a5b044d3
  • alt-php80-odbc_8.0.30-61_amd64.deb
    sha:de88e9dfa5ecee4da5b5cabd0dc054482831c5d2
  • alt-php80-opcache_8.0.30-61_amd64.deb
    sha:2a61b1069dbed5453475cac16133b75be37a1866
  • alt-php80-pdo_8.0.30-61_amd64.deb
    sha:fc2bcd3aef3c75e630e815bed859271ea4fd2f02
  • alt-php80-pgsql_8.0.30-61_amd64.deb
    sha:e2d2c055df685f28460e89fa19f329ffe68375de
  • alt-php80-php-fpm_8.0.30-61_amd64.deb
    sha:88e49fd930aaa3442b42b7f4faea78575064ccf5
  • alt-php80-process_8.0.30-61_amd64.deb
    sha:9061369b9ff3a041d897ac65c7a7c26ad267a44a
  • alt-php80-pspell_8.0.30-61_amd64.deb
    sha:d2e2689f513aedbdf34e04af4feacbe93ec13aec
  • alt-php80-snmp_8.0.30-61_amd64.deb
    sha:26d3da24234f7360da148c08634af6fe3dcbd30f
  • alt-php80-soap_8.0.30-61_amd64.deb
    sha:26904a7499f2a7ff14a5247f7a1ace80fce3c5cb
  • alt-php80-sodium_8.0.30-61_amd64.deb
    sha:02553a2ff67969355f791f4eadef3f89e3dbf932
  • alt-php80-tidy_8.0.30-61_amd64.deb
    sha:892c328758ac2073b18f01d21064837eaa479362
  • alt-php80-xml_8.0.30-61_amd64.deb
    sha:e4b309b7d66cdfe4a1eb68f1dbf2e6f2560e08c7
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.