PHP Security Vulnerability affecting Hosting Services
Dear customers, we would like to clear some uncertainties regarding the PHP versions displayed on your websites.
You may see 8.5.11 PHP version instead of 8.5.12 in your php.ini file because CloudLinux as our vendor maintains its base version string at 8.5.11 as it backports security fixes into its existing package streams (8.5.11-5.el8) version is expected – this version contains backported fixes for both php2shell CVE from official PHP 8.5.12 release: https://changelog.cloudlinux.com/alt-php85
Such approach is applied because there are no 8.5.12 version in CloudLinux implementation.
Same applies for other PHP versions (8.3.35 is displayed instead of 8.3.36, 8.4.26 instead of 8.4.27, etc)
We hope for your understanding on the matter. PHP versions displayed on your websites will correspond to php.net ones once our vendor changes the version number but you may rest assured that all of them have been patched and there is no current threat to your websites since the patches have been released.
