These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
cPanel’s EasyApache 4 25.49 release updates ea-valkey72 from Valkey 7.2.11 to 7.2.12 to address CVE-2026-21863, described by the vendor as a remote denial-of-service condition triggered by a malformed Valkey Cluster bus message. For environments that rely on the packaged Valkey component, this is primarily an availability fix and should be applied promptly.
cPanel’s EasyApache 4 25.46 security release includes a fix for CVE-2026-1642 in ea-nginx. The vendor describes the issue as an SSL backend injection problem and ships the remediation through updated nginx packages and related rebuilds. If you manage cPanel/WHM systems that use EasyApache 4, this is a security update worth applying promptly.
cPanel’s EasyApache 4 25.5 release is a vendor-official security update that references CVE-2025-0167 alongside other CVEs. The supplied source confirms remediation was delivered through updated EasyApache 4 packages, but it does not provide the underlying vulnerability details or clearly map this CVE to a specific component in the excerpt provided.
cPanel’s EasyApache 4 2024.9.18 release includes a security update to libcurl that addresses CVE-2024-8096. The vendor note does not provide technical specifics about the flaw in the supplied corpus, but it does confirm that updated EasyApache 4 packages are available and that libxml2, Pear, and ionCube 13 were also refreshed in the same release. Administrators should treat this as a required maintenance [truncated]
cPanel’s EasyApache 4 25.43 release includes Node.js updates that fix CVE-2025-55132. The vendor describes the issue as an HTTP Request Smuggling vulnerability in the Node.js permission model. For defenders, the key action is to verify whether EasyApache-managed Node.js packages are in use and apply the updated release promptly.
CVE-2025-14177 is an information leak issue in PHP’s getimagesize function that cPanel says was addressed in the EasyApache 4 25.41 security release. The vendor describes this as part of a critical security update spanning PHP 8.1 through 8.5. If your cPanel/WHM environment uses EasyApache 4-managed PHP packages, this is a high-priority update to apply and verify.
cPanel’s EasyApache 4 2024.12.18 release is a vendor-official security update that explicitly names CVE-2024-11053. In the supplied corpus, the advisory ties this CVE to security updates for libcurl and Tomcat 10.1, but it does not provide the flaw class, severity, or exploit details. The safest reading is straightforward: if your cPanel/WHM environment uses EasyApache 4 packages, this release should be t [truncated]
CVE-2025-61772 is referenced in cPanel’s EasyApache 4 25.31 release notes as part of a broader security update set. The supplied corpus does not identify the exact vulnerable package, flaw type, or severity, so the safest interpretation is that this is a vendor-released package update that should be applied promptly on cPanel/WHM systems using EasyApache 4.
cPanel’s EasyApache 4 25.20 release includes a security update for Tomcat 10.1 that addresses CVE-2025-48976. The provided vendor note confirms remediation through the package update, but it does not describe the underlying weakness. Administrators running cPanel/WHM with EasyApache 4 Tomcat 10.1 should treat this as a patching item and verify they are on the updated release.
cPanel’s EasyApache 4 25.28 release includes security updates for NGINX and libcurl to address CVE-2025-53859. The vendor note does not describe the underlying flaw, impact, or severity, so the safest reading is that this is a security fix affecting common web and client networking components delivered through EasyApache 4.
cPanel’s EasyApache 4 2024.11.13 release includes a security update for libcurl to address CVE-2024-9681. Based on the supplied vendor notice, this is a package-level remediation for EasyApache 4 users rather than a standalone cPanel feature change. The corpus does not provide vulnerability mechanics, affected version ranges, or a CVSS score, so the safest response is to treat this as a prompt security ma [truncated]
cPanel’s EasyApache 4 25.26 release includes security updates for NodeJS 20 and ModSecurity 2 that address CVE-2025-27210. The supplied vendor note does not describe the underlying flaw in technical detail, but it does confirm that this CVE is remediated through the EasyApache 4 update path. Administrators running cPanel/WHM environments that rely on EasyApache-managed NodeJS 20 or ModSecurity 2 packages [truncated]
cPanel’s EasyApache 4 25.24 is a vendor security release for Apache 2.4 that includes fixes for CVE-2025-53020 and seven additional CVEs. The supplied advisory confirms this is a security update, but it does not provide CVE-2025-53020-specific technical impact or severity details in the corpus provided here.
cPanel’s EasyApache 4 25.23 release includes Redis security updates that address CVE-2025-32023. The vendor advisory references this CVE directly, but the supplied source corpus does not describe the weakness, affected Redis versions, or exploitation conditions.
cPanel’s EasyApache 4 25.22 release is a vendor-official security update that lists CVE-2025-52891 among the issues addressed by updated PHP packages. The supplied advisory does not describe the underlying flaw, but it does indicate that remediation is available through the EasyApache 4 package update path.
cPanel’s EasyApache 4 25.18 release notes identify CVE-2025-47947 as one of the issues addressed in a security update to ModSecurity 2. In the supplied corpus, no CVSS score, exploit details, or impact description is provided for the CVE itself, so the safest interpretation is to treat this as a vendor-confirmed package-level security fix for EasyApache 4 deployments.
cPanel’s EasyApache 4 25.16 release includes security updates for NodeJS 20 and NodeJS 22 that address CVE-2025-23166. The vendor note also mentions package updates for Ruby Rack, Tomcat 10.1, and APR. The supplied source does not describe the underlying flaw, so the practical takeaway is to keep EasyApache 4 and its Node.js packages current.
cPanel’s EasyApache 4 25.12 release includes a security update for Tomcat 10.1 to address CVE-2025-31651. Based on the supplied vendor advisory, this is a confirmed remediation release, but the source corpus does not include the vulnerability’s technical details, impact, or severity score. Administrators using EasyApache 4 and Tomcat 10.1 should treat the update as important and review the vendor release [truncated]
CVE-2025-43921 is one of three Mailman vulnerabilities referenced by cPanel in a vendor security article published on 2025-04-22 and updated on 2025-04-29. In that advisory, cPanel said it was not aware of vulnerability in cPanel/WHM, briefly tested the proof-of-concept material, and could not reproduce the claims. After additional internal review and third-party subject-matter expert input, cPanel still [truncated]
cPanel’s official support article groups CVE-2025-43920 with CVE-2025-43919 and CVE-2025-43921 affecting Mailman 2.1.39. For cPanel/WHM customers, the vendor states it is not aware of confirmed impact, briefly tested the published PoCs without reproducing the claims, and later said internal and third-party review still could not validate them. Because the advisory does not provide a standalone technical r [truncated]
cPanel’s official guidance for the Mailman 2.1.39 advisory does not confirm that cPanel/WHM is affected by CVE-2025-43919. The vendor says it briefly tested the reported proof-of-concept material and later investigated the claims internally and with third-party subject-matter experts, but was unable to reproduce them using the information provided. The article was updated on 2025-04-28, and the supplied s [truncated]
cPanel’s EasyApache 4 25.14 release notes list security updates for libxml2 and Valkey that address CVE-2025-32415, alongside two other CVEs. The supplied source does not provide the affected version range, component-to-CVE mapping, severity, or exploitation details, so this should be treated as a vendor-published security maintenance update rather than a fully characterized vulnerability advisory.
cPanel’s EasyApache 4 25.10 release notes say the update includes security fixes for PHP 8.1, 8.2, 8.3, and 8.4, including CVE-2025-1736. The provided source does not describe the vulnerability class, impact, or severity, so defenders should treat it as a vendor-confirmed PHP security issue affecting EasyApache 4 deployments until the official CVE record or NVD entry is reviewed.
cPanel’s EasyApache 4 25.9 release is a vendor security update for cPanel/WHM environments. The advisory says updated packages for EasyApache 4 include security fixes for Ruby Rack and Tomcat to address CVE-2025-27610 and CVE-2024-56337. The supplied source does not specify which component maps to which CVE, so the safest reading is that this release should be treated as the vendor-recommended remediation [truncated]
cPanel’s official EasyApache 4 25.8 release notes say the update includes a security fix for Ruby Rack that addresses CVE-2025-27111. The supplied source does not describe the vulnerability class, impact, or severity, so the safest interpretation is to treat this as a vendor-confirmed patch release for EasyApache 4 users and verify that the updated packages are installed.
cPanel’s EasyApache 4 25.7 release includes a security update for Passenger that addresses CVE-2025-26803. The vendor advisory also notes updated packages for Tomcat 10.1, NodeJS 18, and Memcached 1.6. Based on the supplied source corpus, the actionable takeaway is straightforward: operators running cPanel/WHM with EasyApache 4 should verify they have the 25.7 release or later applied so the Passenger fix [truncated]
cPanel’s EasyApache 4 25.6 release includes a security update for libxml2 that addresses CVE-2025-24928. The vendor advisory does not provide technical impact details in the supplied corpus, but it clearly ties the fix to a security release for EasyApache 4. Administrators running cPanel/WHM systems that use EasyApache 4 should treat this as a patching item and confirm the updated packages are installed.
cPanel’s EasyApache 4 25.4 release includes updated Apache 2.4 packages and security updates for NodeJS 18, NodeJS 20, and NodeJS 22 to address CVE-2025-23083. The vendor source identifies the fix at a package-release level, but the supplied corpus does not include vulnerability mechanics, impact scope, or CVSS details. Administrators using cPanel/WHM-managed EasyApache 4 stacks should treat this as a rou [truncated]
cPanel’s EasyApache 4 25.1 release notes identify CVE-2024-46981 as a Redis security issue addressed through updated packages. The vendor notice also mentions refreshed PHP, Memcached, Onigurama, and QOS packages as part of the same release. Based on the supplied source corpus, the actionable takeaway is straightforward: systems relying on cPanel/WHM with EasyApache 4 should be checked for the updated rel [truncated]
cPanel’s EasyApache 4 2024.11.25 release includes security updates for PHP 8.1, 8.2, and 8.3 that address CVE-2024-11233. The vendor release note confirms remediation, but the supplied source material does not provide the underlying flaw details, exploitability, or CVSS information. For administrators, the key takeaway is that the affected PHP package streams were updated through the official EasyApache d [truncated]