EasyApache 4 25.82: cPanel patches ea-libxml2, ea-nginx, ea-ruby27-ruby

cPanel shipped EasyApache 4 build 25.82 in the second week of September 2026, bundling a libxml2 security update, a Ruby resolv fix, and an nginx version bump. None of the individual CVEs here are being called critical, but libxml2 sits underneath enough of the EA4 stack — PHP's XML extensions, Apache modules, and anything parsing XML or HTML server-side — that the patch set is worth running on the next maintenance window rather than waiting for it to roll in with the following build.

What's in 25.82

Eight CVEs in one libxml2 bump is a lot, but that's typical for how upstream libxml2 batches fixes into point releases rather than shipping one advisory per bug — expect the usual mix of out-of-bounds reads, use-after-free conditions in malformed-document parsing, and NULL-pointer crashes rather than a single exploit chain. libxml2 doesn't listen on a network port itself, so none of these are remotely exploitable on their own; the exposure is any code path on the server that hands untrusted XML or HTML to a libxml2-linked library (PHP's DOMDocument, SimpleXML, libxslt, or anything Apache module code parses through it) and then processes attacker-supplied markup.

The ea-ruby27-ruby fix is narrower: it only matters if you've provisioned Ruby applications through EasyApache and those apps use the standard-library resolv gem for DNS resolution rather than a C-extension resolver. If your server doesn't run Ruby at all, skip that line entirely.

The ea-nginx bump to 1.31.5 isn't tied to a CVE in this release — it's a version-tracking update — but it does mean every nginx module compiled against EA4 (ea-nginx-echo, ea-nginx-headers-more, ea-nginx-njs, ea-nginx-passenger, and so on) gets rebuilt against the new base. If you maintain a custom nginx module outside cPanel's own set, rebuild it against 1.31.5 before assuming it still loads.

Check your build

/usr/local/cpanel/bin/easyapache4 --list=installed | grep -E 'libxml2|nginx|ruby27'

Or check the libxml2 version directly, since that's the package that actually matters here:

rpm -q ea-libxml2

Anything reporting a version below 2.15.4 predates this release and is still carrying the eight open CVEs.

Update

/scripts/easyapache4 --upgrade-check
yum update ea-libxml2 ea-nginx ea-ruby27-ruby ea-podman

Or through WHM: Software → EasyApache 4 → Currently Installed Packages → Update Server. The libxml2 update replaces the shared library in place — no rebuild of PHP or Apache is required, but any long-running process that has the old .so mapped into memory (PHP-FPM pools, httpd workers, a persistent Node or Ruby process linking against it) needs a restart to actually pick up the fix:

/scripts/restartsrv_httpd
/scripts/restartsrv_php_fpm

Who's actually exposed

Every cPanel server running EasyApache 4 has ea-libxml2 installed as a dependency, whether or not you think of yourself as running XML anywhere — PHP's core build links against it. In practice the CVEs matter most if you run:

• WordPress or any CMS using SimpleXML/DOMDocument for feed parsing, sitemap generation, or media-library XML handling
• Custom PHP applications that accept user-uploaded XML, SVG, or DOCX/XLSX files (all are XML containers under the hood)
• Any service using libxslt for server-side XSLT transforms

A shared-hosting box running plain HTML/PHP sites with no XML-processing application code has low practical exposure to the libxml2 batch specifically, but should still take the patch — there's no scenario where staying on a vulnerable, unsupported library version is the better option once a fixed build exists.

A current cPanel license is what keeps /scripts/upcp and EasyApache pulling these package updates automatically; a lapsed license leaves a server frozen on whatever build it had when the license expired, CVEs and all.

Next steps

• cPanel TSR-2026-09-08: prepare for the critical WHM patch
• NGINX Rift (CVE-2026-42945): what hosting operators need to do
• EasyApache 4 25.69: cPanel patches six Tomcat CVEs