cPanel 138.0.20 and EA4 25.94: ProFTPD, Unbound and SOAP fixes

Between 26 October and 5 November 2026 cPanel shipped four rounds of builds that carry third-party security fixes but no cPanel advisory of their own. They patch the bundled Unbound resolver, ProFTPD, PowerDNS, Roundcube, and libzip, and EasyApache 4 25.94 patches the SOAP extension in the end-of-life ea-php74, ea-php80, and ea-php81 packages. None of these is a cPanel code flaw, so they get no TSR notice. That makes them easy to miss if you only track security advisories.

Servers on automatic updates have most of this already. This article is for hosts who pin versions, run UPDATES=manual, or keep legacy PHP for customers.

What changed, build by build

138.0.19 is also the fix level for CVE-2026-105476 and CVE-2026-105475, so anyone who patched for those already has the Unbound update.

As of 10 November, the 136 and 134 change logs list no cpanel-proftpd or cpanel-pdns update. The 136 branch ships PowerDNS from the 4.9 series, last updated to 4.9.17 in 136.0.35.

Unbound 1.26.2

NLnet Labs released Unbound 1.26.2 on 21 October with five fixes. cPanel ships it as cpanel-unbound, the server's local validating resolver.

• CVE-2026-97206 (High). A use-after-free in DNS-over-QUIC path migration on multi-threaded deployments.
• CVE-2026-96405 (Medium). Chained name-pointer decompression can degrade service.
• CVE-2026-109125 (Medium). A possible cache-poisoning side channel through unwanted-reply-threshold.
• CVE-2026-50106 (Medium) and CVE-2026-35501 (Low). Both only apply where an island trust anchor sits under an insecure parent zone.

This round is much milder than the May DNSSEC validator RCE, CVE-2026-33278. There is still no reason to stay behind.

ProFTPD 1.3.9d

Both ProFTPD CVEs are SQL injection flaws, and both need SQL modules that most cPanel servers never load:

• CVE-2026-42167 is in mod_sql. It needs a SQLLog directive that writes an attacker-controlled value such as the username into an INSERT or UPDATE query.
• CVE-2026-44331 is in mod_wrap2_sql. It needs UseReverseDNS on. NVD scores it CVSS 3.1 8.1.

Pure-FTPd is cPanel's default FTP server, so check which one you run under WHM » Service Configuration » FTP Server Selection. On ProFTPD servers, confirm that the config doesn't load either module:

rpm -q cpanel-proftpd
grep -Ein 'mod_sql|mod_wrap2|SQLLog|UseReverseDNS' /etc/proftpd.conf

No output from grep means the stock config, which these CVEs don't reach. Update anyway.

PowerDNS 5.1.5

cPanel lists CVE-2026-73206 against cpanel-pdns 5.1.5. The upstream description is a denial of service triggered by a crafted packet when decompressing DNS names. PowerDNS published it in a Recursor advisory and does not spell out the impact on the Authoritative Server, which is the component cPanel ships. Treat it as a DoS fix for your nameservers. If Nameserver Selection shows BIND or Disabled, the package isn't running.

PHP SOAP in ea-php74, 80, and 81

PHP fixed these upstream in its supported branches. EasyApache 4 25.94 backports the fixes to the three end-of-life versions cPanel still packages:

• CVE-2026-91765. SoapServer parses XML recursively with no depth limit. A deeply nested request from an unauthenticated client exhausts the stack and kills the worker.
• CVE-2025-14181. An integer overflow in the SOAP client's buffer check when it parses HTTP responses. A hostile endpoint can crash the PHP process.

Both are denial-of-service bugs, and both only matter where the soap extension is installed:

rpm -qa 'ea-php*-php-soap'
yum update "ea-php*"
/opt/cpanel/ea-php81/root/usr/bin/php -v

After the update, cPanel's patched builds report 7.4.34, 8.0.31, and 8.1.35. Restart PHP-FPM and LiteSpeed's lsphp parents as described in the PHP2Shell patching guide. Without a restart, workers keep running the old code.

Check and patch

/usr/local/cpanel/cpanel -V
rpm -q cpanel-unbound cpanel-pdns cpanel-proftpd
/usr/local/cpanel/scripts/upcp --force

You want 11.138.0.20 or later on 138. On 136 or 134, the 26 October builds (136.0.51 and 134.0.67) are the current security level. If upcp fails, work through fixing cPanel update failures. If you pin versions on purpose, cPanel update tiers explained covers how to stay on a branch and still receive these builds.

One non-security fix in 138.0.20 is worth knowing about. CPANEL-57735 stops license locks caused by the reported MAC address alternating on servers with multipath default routes. If a multi-homed server keeps throwing invalid license errors, update before you open a ticket. upcp only reaches these builds while the server's cPanel license is active.

Next steps

• cPanel CVE-2026-105476 and 105475: the cPanel advisory fixed in 138.0.19.
• CVE-2026-33278, the cpanel-unbound DNSSEC RCE: background on how cPanel uses Unbound.
• Fix cPanel update failures: when upcp refuses to move.