Last modified: 2026 June 9

Sitejet Builder 4.9.0-1

2026 June 4

Improved permission and domain-ownership validation

Improve permission and domain-ownership validation for Sitejet actions.

For a full list of changes, read the Sitejet Builder change log.

Comet Backup 1.5.4

2026 June 03

Bug fixes and improvements

This release stops Comet backups from consuming all local disk space during a backup run, fixes restore backup options being hidden in the UI when no backup jobs exist, ensures the outbound User-Agent is not inherited from the parent process, removes the credentials download warning, and ensures Comet database restores fail explicitly when restorepkg errors out rather than reporting silent success.

EasyApache 4 25.64

2026 June 3

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release patches CVE-2026-49975 in ea-apache24. Attackers can craft malicious HTTP/2 cookie headers that multiply across streams, consuming excessive memory. The fix makes cookie headers count against LimitRequestFields. Note: HTTP/2 is not enabled by default in cPanel configurations.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.63

2026 May 22

Hotfix security release

We released updated packages for EasyApache 4. This release addresses CVE-2026-9256 (nginx-poolslip), a critical remote code execution vulnerability affecting all nginx versions, fixed in ea-nginx 1.31.1. Phusion Passenger was also updated to version 6.1.3.

For a full list of changes, read the EasyApache 4 change log.

Sitejet Builder 4.8.0-1

2026 May 21

Updated publish/polling access controls

Improve Sitejet publish/polling access controls.

For a full list of changes, read the Sitejet Builder change log.

cPanel & WHM Security Update

2026 May 21

Security updates

We released a security update for cPanel & WHM versions 136, 134, and 126.

This release updates cpanel-unbound to version 1.25.1, addressing 11 vulnerabilities including CVE-2026-33278 (CVSS 9.1 CRITICAL - possible remote code execution during DNSSEC validation), CVE-2026-42944, CVE-2026-42959, CVE-2026-32792, CVE-2026-40622, CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42960, CVE-2026-44390, and CVE-2026-44608.

For a full list of changes, visit the cPanel & WHM change logs and select your version.

EasyApache 4 25.62

2026 May 21

Hotfix security release

We released updated packages for EasyApache 4. This release addresses CVE-2026-8711 in ea-nginx-njs and CVE-2026-47783, CVE-2026-47784 in ea-memcached16.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.61

2026 May 20

Maintenance release

We released updated packages for EasyApache 4.

For a full list of changes, read the EasyApache 4 change log.

ConfigServer Security & Firewall (CSF) 16.20-1

2026 May 19

Bug fixes

Fixed regex.custom.pm custom rules silently failing to match log lines (CPANEL-53173). Fixed csf -cf $file no longer retaining newlines in the file (CPANEL-52801).

For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

Server Monitoring Powered by 360 Monitoring 2.5.0-1

2026 June 03

SPA modal notification for new activations

SPA modal notification after plugin activation. New partner rollout.

For a full list of changes, read the Server Monitoring change log.

Server Monitoring Powered by 360 Monitoring 2.4.0-1

2026 May 18

Conditional Server Monitoring registration

Server Monitoring now only registers in WHM when it has been set up.

For a full list of changes, read the Server Monitoring change log.

Server Monitoring Powered by 360 Monitoring 2.3.0-1

2026 May 14

New “Start Monitoring” onboarding experience

We updated the server monitoring setup flow. New servers no longer automatically create anonymous accounts. A new “Start Monitoring” button in the top widget lets users set up monitoring for servers without an anonymous account on demand.

For a full list of changes, read the Server Monitoring change log.

EasyApache 4 25.60

2026 May 13

Security update

We released updated packages for EasyApache 4.

This security release addresses CVE-2026-42945 (Critical: heap buffer overflow in ngx_http_rewrite_module) in ea-nginx (v1.30.0 to v1.31.0), along with rebuilds of ea-nginx-echo, ea-nginx-headers-more, ea-nginx-passenger, and ea-nginx-njs against the patched version.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.59

2026 May 13

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release addresses CVE-2026-43515 and CVE-2026-43512 (Moderate) and five Low-severity CVEs in ea-tomcat101 (v10.1.54 to v10.1.55), and includes a heap buffer overflow fix in ea-apache24-mod_security2 (no CVE assigned) along with updates to ea-valkey72, ea-redis62, ea-nginx-njs, ea-wappspector, and ea-apache24-mod_lsapi.

For a full list of changes, read the EasyApache 4 change log.

cPanel & WHM Security Update

2026 May 8

Security updates

We released a security update for all supported cPanel & WHM versions (136, 134, 132, 130, 126, 124, 118, 110, 102, 94, and 86).

This release patches three vulnerabilities: an arbitrary file read in the LOADFEATUREFILE adminbin call (CVE-2026-29201), a Perl code injection vulnerability in the create_user API call (CVE-2026-29202), and an unsafe symlink handling error that allows a user to chmod an arbitrary file, enabling denial of service and possible privilege escalation (CVE-2026-29203).

For a full list of changes, visit the cPanel & WHM change logs and select your version.

EasyApache 4 25.58

2026 May 8

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release addresses CVE-2026-6735, CVE-2026-7259, CVE-2025-14179, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, and CVE-2026-7258 in ea-php82, ea-php83, ea-php84, and ea-php85.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.57

2026 May 05

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release updates ea-apache24 to 2.4.67, addressing 11 CVEs including an important remote code execution vulnerability (CVE-2026-23918 in mod_http2). It also patches ea-libcurl (CentOS 7 only) with 6 security fixes backported from curl 8.20.0.

For a full list of changes, read the EasyApache 4 change log.

ConfigServer Security & Firewall (CSF) 16.18-1

2026 May 4

Managesieve LFD alert fix

Added managesieve-login to csf.pignore to prevent excessive LFD resource alerts triggered by the Dovecot managesieve plugin (CPANEL-52448).

For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

ConfigServer Security & Firewall (CSF) 16.17-1

2026 May 4

LFD startup and detection fixes

Fixed multiple LFD issues: brute-force IMAP/POP3 login failure detection on Dovecot 2.4, LFD not starting after cPanel version upgrades, firewall rules failing to load after package upgrades, and LFD startup crashes when /etc/csf/csf.error is absent.

For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

cPanel Store Annual License Offering

2026 May 4

Annual billing now available for Solo, Admin, and Pro licenses

Annual billing is now available for cPanel Solo ($329.49/year), Admin ($395.49/year), and Pro ($593.49/year) licenses in the cPanel Store. Annual subscriptions save approximately 8.4% compared to monthly pricing. cPanel Premier is not available on a yearly billing cycle at this time.

This release also introduces product anniversary billing for new cPanel Store purchases. New services renew on the same calendar day each month or year rather than being prorated to the 1st of the month. Existing services are unaffected.

EasyApache 4 25.56

2026 April 29

Maintenance updates

We released updated packages for EasyApache 4.

This maintenance release updates ea-nginx-njs from v0.9.6 to v0.9.7 and marks ea-scl-php54, ea-scl-php55, ea-scl-php56, ea-scl-php70, ea-scl-php71, ea-scl-php72, ea-scl-php73, ea-php74, ea-php80, ea-php81, ea-nodejs16, ea-nodejs18, ea-scl-ruby24, and ea-ruby27 as end-of-life.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.55

2026 April 22

Maintenance updates

We released updated packages for EasyApache 4.

This maintenance release includes an ea-nginx update from v1.29.8 to v1.30.0 with five associated module rebuilds, a libxml2 update from v2.15.2 to v2.15.3, and an nghttp2 update from v1.68.1 to v1.69.0.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.10.1

2026 April 15

Fixed enabling Vulnerability Protection with large vulnerability sets

Enabling Vulnerability Protection no longer fails with a STDIN data is corrupted error when a WordPress installation contains a large number of vulnerabilities.

EasyApache 4 25.54

2026 April 15

Security and maintenance updates

We released updated packages for EasyApache 4.

This security and maintenance release includes a security patch for ea-openssl11 (CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390), version updates for ea-php84 (8.4.19 to 8.4.20) and ea-php85 (8.5.4 to 8.5.5), and an ea-nginx update to v1.29.8 with associated module rebuilds.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.10.0

2026 April 14

Security Risk ratings for WordPress sites and components

WP Toolkit now introduces a Security Risk rating for WordPress sites and individual components. This rating helps administrators quickly identify which vulnerable sites or plugins require attention first.

As part of this change, the previous Vulnerabilities widget was replaced with a new Security Risk widget, and the WordPress Vulnerabilities tab was redesigned and renamed to Vulnerable Components. The new tab displays installed WordPress components along with their Security Risk ratings. Selecting a component expands the view to show detailed information about the underlying vulnerabilities.

WP Toolkit now uses the Security Risk rating throughout the interface, including:

• Site cards, where the Vulnerabilities label was replaced with a Security Risk label.
• The Mass Security screen, which now shows site information in a separate tab with a dedicated Security Risk column.
• Email notifications, which were redesigned to focus on Security Risk rating changes rather than raw vulnerability counts.

WordPress installations can now be sorted by Security Risk, allowing administrators to prioritize remediation more efficiently. As part of this redesign, the Ignore Low‑Risk Vulnerabilities feature was removed, as it is no longer meaningful when Security Risk ratings are used.

Redesigned WP Toolkit plugin interface

WP Toolkit includes a redesigned WordPress integration plugin UI to support the new Security Risk feature and related workflows.

Administrators can now:

• Change autoupdate settings directly from the WP Toolkit plugin.
• Purchase Vulnerability Protection directly from within the plugin.

To customize the Vulnerability Protection purchase URL on cPanel servers, set the following option in the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

whmVirtualPatchesUpsellUrl = <custom URL>

For improved security, WP Toolkit now uses secure one‑time login links when logging in to WordPress from WP Toolkit.

The WP Toolkit link inside the WordPress admin interface was also moved under the Dashboard menu by default.

Mass plugin rollout and automated site scanning

WP Toolkit can now mass‑install the WP Toolkit plugin on all existing WordPress sites on a server.

To enable this behavior, add the following line to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

rolloutIntegrationPluginToExistingSites = true

Plugin installation is rate‑limited to 100 sites per hour to avoid excessive server load.

WP Toolkit can now also scan automatically for new WordPress instances every 24 hours. To enable scheduled scans, add the following line to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

scanInstancesPeriodically = true

Improvements to plugins, themes, and filtering

WP Toolkit now includes improved filtering capabilities:

• Plugins and Themes tabs on site cards now support filtering by component name.
• Global Plugins and Themes screens can be filtered by domain and component name.

Cron behavior and update improvements

Server administrators can now control how often wp-cron.php scheduled tasks run by default using the wpCronFrequency configuration option. The default frequency was changed from once per hour to every five minutes.

The Take over wp-cron.php option will now always create a replacement scheduled task automatically.

Smart Update and Smart PHP Update now generate text logs for successful prognoses, rather than only for failed updates.

Performance and reliability improvements

WP Toolkit now pre‑downloads the latest WordPress archive on clean installation and refreshes it once per day.

Performance was improved for the following operations:

• Site data refresh
• Switching themes
• Activating or deactivating plugins

WP Toolkit plugin performance was improved.

The default HTTP timeout for connections to wordpress.org was increased from 15 seconds to 60 seconds. Multiple security‑related improvements were also implemented.

Other changes

• The wp-cli instance info command now also displays the minor WordPress version available for update.
• A new WordPress Security widget was added to the WHM Home screen.
• WP Guardian (cPanel addon) – 50‑site pack is now available for purchase from the cPanel Store.
• WP Toolkit log files are now correctly rotated when ProtectSystem is set to full.
• WP Toolkit now works correctly on CloudLinux 9 Solo.
• Ongoing Smart Update or Smart PHP Update tasks no longer block access to the WP Toolkit interface under certain conditions.
• CLI option -password is now fully deprecated for security reasons. Use the ADMIN_PASSWORD environmental variable instead.

Bug fixes

This release includes multiple fixes that improve Smart Update reliability, WordPress cloning and copying, UTF‑8 handling in the UI, and plugin activation workflows.

Server Monitoring 2.2.0-1

2026 April 13

Updated monitoring polling interval

DUCKS-5510: We updated the monitoring polling interval for signed and anonymous accounts. We also updated the permissions for the agent360.sh script.

For a full list of changes, read the Server Monitoring change log.

EasyApache 4 25.53

2026 April 08

Security and maintenance updates

We released updated packages for EasyApache 4.

This security and maintenance release includes CVE fixes for ea-ruby27-rubygem-rack (CVE-2026-34830, CVE-2026-34785) and ea-modsec2-rules-owasp-crs (CVE-2026-33691), and maintenance updates for ea-tomcat101, ea-re2c, and ea-cpanel-tools.

For a full list of changes, read the EasyApache 4 change log.

cPanel & WHM version 136

2026 April 07

cPanel & WHM updates now provide ConfigServer Security & Firewall (CSF)

WebPros International, LLC has created a fork of CSF (ConfigServer Security & Firewall) for cPanel & WHM. We distribute this new fork of CSF via our update mirrors. cPanel & WHM will migrate any unsupported or outdated version of CSF to our supported fork of CSF.

We have also added CSF as a recommendation to WHM’s Security Advisor interface (WHM » Home » Security Center » Security Advisor). For more information, read our How to Install ConfigServer Security & Firewall (CSF) documentation.

Added support for MariaDB 11.8

We added support for MariaDB® 11.8. MariaDB 11.8 now appears as an option in WHM’s Upgrade Database Version interface (WHM » Home » Database Services » Upgrade Database Version). For more information, read MariaDB’s MariaDB 11.8 Changes & Improvements documentation.

Added support for short-lived SSL certificates

We added support to issue and renew short-lived certificates for all SSL certificate types (including paid certificates). These short-lived certificates expire after 47 days and renew automatically via the ACME protocol.

Added unified SSL/TLS interface

We added cPanel’s SSL/TLS Certificates interface (cPanel » Home » Security » SSL/TLS Certificates). This interface presents a unified SSL/TLS management experience that simplifies certificate management and navigation for cPanel users.

Added Web Log Retention interface

We added WHM’s Web Log Retention interface (WHM » Account Functions » Web Log Retention). This interface provides visibility and control over all your cPanel accounts’ web server log retention settings.

Added combined PHP error logging and interface updates

cPanel & WHM now combines each cPanel account’s PHP error logs into the ~username/logs/php.error.log file, where username is the account’s username. This behavior provides a single log file for all domains under the account and simplifies both the logging and log file-rotation processes.

• Server administrators can now manage PHP error-logging across all accounts in WHM’s MultiPHP INI Editor interface (WHM » Home » Software » MultiPHP INI Editor).
• cPanel users can manage logging for their account’s domains in cPanel’s MultiPHP INI Editor interface (cPanel » Home » Software » MultiPHP INI Editor).

Improved visibility of EOL and hardened PHP versions

We improved the visibility of EOL (End-of-Life) and hardened PHP versions in WHM’s MultiPHP Manager interface (WHM » Home » Software » MultiPHP Manager). For more information, read our TuxCare Extended Lifecycle Support (ELS) for PHP documentation.

Enabled WebPros Account global logout

When you use your WebPros account to log in to your cPanel & WHM server and then log out from cPanel & WHM, the system will log you out from all WebPros Account sessions. This is consistent with the expected behavior of SSO (single sign-on) authentication systems.

Updated Contact Manager with Package Manager lock notification

We added a new notification for long-running package manager locks to WHM’s Contact Manager interface (WHM » Home » Server Contacts » Contacts Manager).

Third-party application changes

For information on changes to our third-party applications, read our Third-Party Applications Updates documentation.

Removed RubyGems and Ruby on Rails

We removed cPanel’s RubyGems and Ruby on Rails interfaces. For more information, read our cPanel Deprecation Plan documentation.

Removed ICQ notifications

We removed support for ICQ notifications in WHM’s Contact Manager interface (WHM » Home » Server Contacts » Contact Manager). For more information, read our cPanel Deprecation Plan documentation.

New UAPI functions

• DNS::is_svcb_available — This function shows whether the server supports SVCB DNS records.
• SSL::get_autossl_renewal_status — This function returns the AutoSSL renewal status for a domain.

New WHM API 1 functions

• is_svcb_available — This function shows whether the server supports SVCB DNS records.
• set_360_agent_polling — This function updates the agent360 polling settings.

Deprecated WHM API 1 functions

• get_available_featurelists — Use WHM API 1’s get_featurelists function.
• read_featurelist — Use WHM API 1’s get_featurelist_data function.
• disable_mail_sni — Use UAPI’s SSL::disable_mail_sni function.

Removed WHM API 1 functions

• verify_icq_access — We removed this function as part of the ICQ notifications removal.
• verify_oscar_access — We removed this function as part of the ICQ notifications removal.

New scripts

• /usr/local/cpanel/scripts/show_php_settings — This script returns the PHP settings for all domains on the server.
• /usr/local/cpanel/scripts/mass_change_php_setting — This script updates every domain that uses a specific PHP version to another PHP version.

Modified scripts

The /usr/local/cpanel/scripts/maintenance script now detects package manager locks that remain active for more than 12 hours.

Upgrade blockers

Ubuntu 22

You cannot upgrade to cPanel & WHM version 136 if your server runs Ubuntu® 22. If your server runs Ubuntu 22.04, you should migrate to Ubuntu 24.04 LTS via ELevate, then upgrade to cPanel & WHM version 136. For more information, read our cPanel Deprecation Plan documentation.

Package Manager locks

You cannot upgrade to cPanel & WHM version 136 if your Package Manager is actively holding locks. You must remove the active locks to proceed. For more information, read our Package Manager Locks documentation.

Sitejet Builder 4.7.1-1

2026 April 9

Updated Sitejet default feature list

Sitejet Builder no longer enables itself in standalone Nova’s default feature list.

For a full list of changes, read the Sitejet Builder change log.

Sitejet Builder 4.7.0-1

2026 April 7

Maintenance updates

Package build maintenance updates for Sitejet Builder.

For a full list of changes, read the Sitejet Builder change log.

Site Quality Monitoring 3.1.0-1

2026 April 7

Maintenance updates

Package build maintenance updates for Site Quality Monitoring.

For a full list of changes, read the Site Quality Monitoring change log.

Server Monitoring 2.1.0-1

2026 April 7

Maintenance updates

Package build maintenance updates for Server Monitoring.

For a full list of changes, read the Server Monitoring change log.

EasyApache 4 25.52

2026 April 1

Security and maintenance updates

We released updated packages for EasyApache 4.

This security and maintenance release addresses 6 CVEs in ea-nginx 1.29.7, 7 CVEs in ea-nodejs22 and ea-nodejs20, and 1 CVE in ea-nghttp2 (CVE-2026-27135). It also includes a proxy configuration fix for Apache 2.4.64+ compatibility, nginx module rebuilds, and version updates for ea-libxml2, ea-re2c, ea-tomcat101, and PHP memcached extensions.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.51

2026 March 19

Maintenance and security updates

We released updated packages for EasyApache 4.

This maintenance and security release includes security backports for ea-libcurl (4 CVEs from curl 8.19.0), version updates for ea-php84, ea-php85, and ea-nginx, and bug fixes for ea-apache24 and ea-cpanel-tools.

For a full list of changes, read the EasyApache 4 change log.

ConfigServer Security & Firewall (CSF) 16.12-1

2026 March 18

Package removal cleanup fix

Fixed an issue where uninstalling cpanel-csf left the CSF plugin entry and LFD service status behind in WHM (CPANEL-51933). Also suppresses harmless errors on missing symlinks during upgrades.

For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

EasyApache 4 25.50

2026 March 10

Maintenance updates

We released updated packages for EasyApache 4.

This maintenance release includes bug fixes for ea-nginx and version updates for ea-nginx-njs, ea-memcached16, ea-ruby27-libuv, ea-nodejs22, and ea-nodejs20.

For a full list of changes, read the EasyApache 4 change log.

ConfigServer Security & Firewall (CSF) 16.11-1

2026 March 6

Package upgrade behavior fix

Fixed an issue where upgrading cpanel-csf would overwrite custom csf-cron entries.

For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

EasyApache 4 25.49

2026 March 4

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release addresses 2 CVE vulnerabilities in ea-valkey72: CVE-2026-21863 (Remote DoS with malformed Valkey Cluster bus message) and CVE-2025-67733 (RESP Protocol Injection via Lua error_reply). Valkey updates from 7.2.11 to 7.2.12.

For a full list of changes, read the EasyApache 4 change log.

Site Quality Monitoring 3.0.1-0

2026 March 4

Maintenance updates

We released minor UI fixes, updated the check interval for Pro plans, updated table comparisons, and updated translations.

For a full list of changes, read the Site Quality Monitoring change log.

Sitejet Builder version 4.6.0-1

2026 March 4

Improved website publishing reliability

Sitejet Builder now downloads the correct assets more reliably during website publishing.

For a full list of changes, read the Sitejet Builder change log.

ConfigServer Security & Firewall (CSF) 16.08-1

2026 February 25

WebPros now maintains CSF for cPanel & WHM

WebPros International has assumed stewardship of ConfigServer Security & Firewall (CSF) and repackaged it as the cpanel-csf RPM. CSF now installs and updates through the standard cPanel package management system on all supported cPanel & WHM versions. Support for non-cPanel platforms has been removed; this package is exclusively for cPanel & WHM environments.

Security improvements and codebase modernization

This release addresses XSS vulnerabilities in the CSF web UI and improper HTML encoding throughout. The codebase has been modernized with cPanel-native Perl libraries and a 100+ test suite. IPv6 handling, timeout validation, and log parsing for AlmaLinux 10 have also been corrected.

Package-managed updates

CSF now updates through the cPanel package manager. The previous AUTO_UPDATES feature has been removed. Keep your cPanel & WHM installation current to receive CSF security and stability patches automatically.

For a full list of changes, read the ConfigServer Security & Firewall (CSF) change log.

EasyApache 4 25.48

2026 February 25

Maintenance updates

We released updated packages for EasyApache 4.

This maintenance release introduces ioncube15 as a new package (IonCube 15 with php8.5 beta support), updates Apache mod_qos (11.77 to 11.78), and adds historical CVE references to the Tomcat 10.1 changelog.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.47

2026 February 18

Maintenance updates

We released updated packages for EasyApache 4.

This maintenance release includes updates to Apache mod_qos (11.76 to 11.77), PHP 8.4 (8.4.17 to 8.4.18), PHP 8.5 (8.5.2 to 8.5.3), libuv for Ruby 2.7 (1.51.0 to 1.52.0), and Rack for Ruby 2.7 (2.2.21 to 2.2.22).

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.46

2026 February 11

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release addresses 2 CVE vulnerabilities: CVE-2026-1642 (ea-nginx) involving SSL backend injection and CVE-2026-21876 (ea-modsec2-rules-owasp-crs) affecting multipart charset validation. The release includes updates to nginx (1.29.4 to 1.29.5) and ModSecurity OWASP Core Rule Set (3.3.7 to 3.3.8), along with rebuilds of nginx-related packages.

For a full list of changes, read the EasyApache 4 change log.

Site Quality Monitoring 3.0.0-1

2026 February 5

We added the Site Quality Monitoring widget to cPanel’s Home interface. This widget allows users to quickly view the monitoring status of their websites. It also allows them to add monitoring to their unmonitored websites in cPanel’s Site Quality Monitoring interface (cPanel » Home » Metrics » Site Quality Monitoring).

EasyApache 4 25.45

2026 February 4

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release includes 7 CVE fixes for OpenSSL 1.1.1 addressing heap buffer overflow, NULL pointer dereference, and ASN1 validation issues. The release also includes PHP packages migrating to system libxml2 on AlmaLinux 9+ to resolve Imagick segfault issues, PEAR updates for all PHP versions (1.10.17 to 1.10.18), and updates to Tomcat (10.1.50 to 10.1.52) and Passenger (6.1.1 to 6.1.2).

For a full list of changes, read the EasyApache 4 change log.

Comet Backup 1.1.1

2026 January 22

Initial public release

This is the initial public release of the Comet Backup plugin. Selected cPanel partners can use WHM’s Comet Backup interface (WHM » Home » Plugins » Comet Backup) to easily and securely back up and restore their users’ files, directories, and databases. This interface uses Comet Backup technology to provide data protection for disaster recovery and business continuity.

EasyApache 4 25.44

2026 January 21

Updated packages

We released updated packages for EasyApache 4.

This release includes updates for Apache HTTP Server mod_http2, WHM server status endpoint obfuscation, and updates to PHP 8.5.2, PHP 8.4.17, and PHP 8.3.30.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.43

2026 January 15

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release includes updates to Node.js 20.20.0 and Node.js 22.22.0 with fixes for CVE-2025-55132 (HTTP Request Smuggling vulnerability in permission model) and CVE-2025-59465 (TLSSocket default error handler vulnerability). The release also includes updates to njs 0.9.5 and ea-cpanel-tools supporting PHP 8.2 as the default.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.9.3

2026 January 14

Security improvements & fixes

This release includes security improvements and bug fixes.

cPanel & WHM version 134

2026 January 07

Added CloudLinux 10 support

We added support for the CloudLinux™ 10 operating system. For more information, read our System Requirements for CloudLinux installation guide.

Added TuxCare ELS for PHP

cPanel & WHM provides the most recent stable versions of PHP. If you require updates to unsupported PHP versions, we recommend that you get the TuxCare Extended Lifecycle Support (ELS) for PHP service. This service provides hardened and secured legacy PHP versions and patches them against all known vulnerabilities.

Require WebPros Account on installation

We added the option to require WebPros Account for WHM logins as part of the cPanel & WHM installation process. For more information, read our WebPros Account documentation.

Enabled SSL/TLS Wizard by default

We enabled the SSL/TLS Wizard feature by default in WHM’s Feature Manager interface (WHM » Home » Packages » Feature Manager). This change allows end users to purchase certificates directly through cPanel’s SSL/TLS Wizard interface (cPanel » Home » Security » SSL/TLS Wizard) without waiting for server administrator setup.

Added Tweak Setting to protect CalDAV and CardDAV

We added the Enable CalDAV/CardDAV DoS Protection setting to the Security section of WHM’s Tweak Settings interface (WHM » Home » Server Configuration » Tweak Settings). This setting protects the CalDAV and CardDAV services from Denial-of-Service (DoS) attacks by limiting the content length and size of CalDAV and CardDAV requests.

Added Dovecot configuration for service subdomain

We added the ability to configure whether Dovecot includes service subdomains in the list of SNI hostnames. For more information, read WHM’s Mailserver Configuration interface (WHM » Home » Service Configuration » Mailserver Configuration) documentation.

Third-party application changes

For information on changes to our third-party applications, read our Third-Party Applications Updates documentation.

New UAPI functions

• DNS::is_https_available — This function fetches information regarding HTTPS records support.

New WHM API 1 functions

• is_https_available — This function fetches information regarding HTTPS records support.

Modified UAPI functions

• Fileman::get_file_information — We improved this function’s integration with the Jodit Editor.
• Fileman::list_files — We improved this function’s integration with the Jodit Editor.

Removed UAPI functions

• SiteTemplates::list_site_templates — We removed this function as part of the Site Publisher removal.
• SiteTemplates::list_user_settings — We removed this function as part of the Site Publisher removal.
• SiteTemplates::publish — We removed this function as part of the Site Publisher removal.

New scripts

• /usr/local/cpanel/scripts/install_tuxcare_els_php — This script installs the TuxCare Extended Lifecycle Support (ELS) for PHP service.

Removed scripts

• /usr/local/cpanel/scripts/process_site_templates — We removed the /usr/local/cpanel/scripts/process_site_templates script as part of the Site Publisher removal.

Removed Site Publisher

We removed cPanel’s Site Publisher interface. For more information, read our cPanel Deprecation Plan documentation.

Upgrade Blockers

Blocked Rocky Linux 8 and 9

You cannot upgrade to cPanel & WHM version 134 if your server runs Rocky Linux™ 8 or 9. For more information, read our cPanel Deprecation Plan documentation.

EasyApache 4 25.42

2026 January 7

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release includes a critical fix for an XSS and email injection vulnerability in the 404 error page (CPANEL-47168 / SEC-68753). The release also includes updates to NGINX 1.29.4 with lsapi support, Passenger 6.1.1, memcached 1.6.40, SourceGuardian 17.0.0, and moves ea-nginx-passenger out of experimental status.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.41

2025 December 18

Security updates

We released updated packages for EasyApache 4.

This critical security release includes updates to PHP 8.1, 8.2, 8.3, 8.4, and 8.5, addressing following three CVEs:

• CVE-2025-14177 - Information leak in the getimagesize function.
• CVE-2025-14178 - Heap buffer overflow in the array_merge function.
• CVE-2025-14180 - PDO quoting result in a segmentation fault (null deref).

This release also includes the initial meta package build for PHP 8.5.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.40

2025 December 17

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to Tomcat 10.1.50, NGINX 1.29.4 (and rebuilds for related nginx modules), and the ea-scl-php-pear meta package.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.39

2025 December 8

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release includes an update to Apache HTTP Server 2.4.66, which fixes five CVEs (two moderate, three low severity). We also backported a fix from mod_md version 2.6.7 to address an MDStapleOthers configuration regression and updated ea-cpanel-tools to restore a missing dependency.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.9.2

2025 December 3

WordPress plugin white‑labelling support

WP Toolkit’s WordPress plugin now supports white‑labelling. Server administrators can customize the plugin name displayed in the WordPress admin interface.

To change the plugin name, add the following option to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

integrationPluginCustomizationsDisplayName = "New Plugin Name"

EasyApache 4 25.38

2025 December 3

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to NodeJS 20, PHP 8.4, PHP 8.3, FreeTDS, nginx-echo module, and Ruby Passenger.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.37

2025 November 25

Updated packages

We released updated packages for EasyApache 4.

This special release includes the official release of PHP 8.5.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.9.1

2025 November 20

We published this maintenance release for bug fixes and security improvements.

EasyApache 4 25.36

2025 November 20

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to Tomcat 10.1, NodeJS 22, ModSecurity 3, and Passenger.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.35

2025 November 13

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to libxml2, PHP 8.3, and PHP 8.4.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.9.0

2025 November 12

Added WP Toolkit plugin to WordPress interface

We added a WP Toolkit plugin to the WordPress® administrative interface. Site admins can now access WP Toolkit vulnerability information directly from the WordPress admin dashboard. The plugin detects when WordPress directly installs or updates plugins and themes and immediately applies mitigation strategies.

To enable the interface on existing plugin installations, add the following lines to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

1
2
3

integrationPluginApi = true
integrationPluginUiModuleEnabled = true
integrationPluginEventModuleEnabled = true

To allow site administrators to install the plugin, add the following additional line to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

integrationPluginPromo = true

To automatically install the plugin on all new WordPress installations, add the following additional line to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

installIntegrationPluginToNewSites = true

Restore backups on different platforms

You can easily restore backups made in WP Toolkit version 6.9 on different servers and platforms, for example, a backup from Plesk restored on cPanel or a backup from cPanel restored on Plesk.

To restore a backup from another domain or server, perform the following steps:

1. Create a new WordPress site on the target domain.
2. Upload the backup.
3. Make sure the Hide backups from other domains option is off.
4. Find your backup in the list and restore it. The restoration process will automatically update the relevant paths and URLs.

Improved vulnerability protection rules

In most cases, WP Toolkit now immediately applies vulnerability protection rules and other mitigation policies without waiting for the hourly maintenance task. WP Toolkit also now applies vulnerability protection rules to ignored low-risk vulnerabilities.

Other changes

• WP Toolkit now supports cloning and copying data between WordPress installations that use the Redis Object Cache plugin.
• We made accessibility and security improvements and bug fixes.
• We shortened the Feature Showcase text for the WP Guardian addon.
• We will deprecate the -password CLI option in the next major version of WP Toolkit (version 6.10). Use the ADMIN_PASSWORD environmental variable instead.

EasyApache 4 25.34

2025 November 6

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to Ruby Rack, FreeTDS, NGINX Passenger, NGINX NJS, and Redis 6.2.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.33

2025 October 30

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to NodeJS 22, NGHTTP2, Tomcat 10.1, SourceGuardian, PHP 8.3, and PHP 8.4. It also includes a security update for OpenSSL 1.1.1w to address CVE-2025-9230.

For a full list of changes, read the EasyApache 4 change log.

Sitejet Builder version 4.4.0-1

2025 October 21

Integrated Cloudflare Turnstile CAPTCHA

Sitejet Builder now includes the Cloudflare® Turnstile CAPTCHA solution. For each CAPTCHA element, you can now choose either a built-in CAPTCHA or a Turnstile solution.

To set up Turnstile, you must first create a Cloudflare account. Then, read the SiteJet Turnstile CAPTCHA documentation to learn how to create a Turnstile widget and include it in SiteJet Builder.

EasyApache 4 25.32

2025 October 16

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to Ruby Rack, Tomcat 10.1, NGHTTP2, and Ruby Passenger.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.31

2025 October 8

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to NodeJS 22, NGINX NJS, Tomcat 10.1 and Passenger. It also includes security updates for Ruby Rack, Redis, and Valkey to address CVE-2025-61772, CVE-2025-61771, CVE-2025-61770, CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, and CVE-2025-46819.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.8.3

2025 October 2

Added Ubuntu support

We added support for the Ubuntu® 24.04 operating system. You can now use WP Toolkit on Ubuntu servers.

EasyApache 4 25.30

2025 October 1

Updated package

We released an updated package for EasyApache 4.

This release includes an update to PHP 8.3.

For a full list of changes, read the EasyApache 4 change log.

cPanel & WHM version 132

2025 September 30

Upgrade Blockers

MySQL 5.5 and 5.6

If your server runs a cPanel-provided MySQL version 5.5 or 5.6, you must upgrade to a supported database software version to install or upgrade to cPanel & WHM version 132.

AlmaLinux OS 9, Rocky Linux™ 9, and CloudLinux OS 9

To install or upgrade to cPanel & WHM version 132, systems running RHEL 9-derived distributions must be on version 9.5 or later.

Upgraded temporary domains for cPanel accounts

In cPanel & WHM version 132, we expanded the functionality of temporary domains for cPanel users. You can now create temporary domains for parked and addon domains, and convert your own temporary domain to a registered domain in cPanel’s Domains interface (cPanel » Home » Domains » Domains).

However, you cannot convert your account’s main domain from a temporary domain to a registered domain. To make changes to your primary domain, contact your hosting provider.

Updated Dovecot to version 2.4

In cPanel & WHM version 132, we updated Dovecot to version 2.4. This major upgrade includes changes to configuration parameters, and if you use a .local file for your configuration you must update your templates for the changes.

This update also includes changes to password hashing and blocks the use of weak password hashing. This means that accounts that use a hashing method such as MD5 will not be able to log in to IMAP or POP3 to retrieve email.

To get around this issue, set your PAM configuration to use a stronger hashing scheme.

You can also set the Allow Weak Authentication Schemes setting in WHM’s Mailserver Configuration interface to Yes. Both of these options will allow users to log in and change their password. We strongly recommend that you update your PAM configuration and force a password change if you are using a less secure hashing method. For more information, read about Dovecot’s password schemes.

For more information about changes to Dovecot in version 2.4, read the Dovecot documentation.

Added Sieve filtering to Dovecot and Roundcube

In cPanel & WHM version 132, we added support for Sieve filtering to Dovecot and Roundcube. You can now use Sieve to filter incoming email messages directly in Roundcube.

Added support for AlmaLinux 10

In cPanel & WHM version 132, we added support for the AlmaLinux OS 10 operating system. For more information about this operating system, read our System Requirements for AlmaLinux OS and our Third Party Software End of Life Policy documentation.

Added support for Ubuntu 24

In cPanel & WHM version 132, we added support for the Ubuntu® 24 LTS operating system. For more information about this operating system, read our System Requirements for Ubuntu and our Third Party Software End of Life Policy documentation.

Upgraded Perl

cPanel & WHM now uses Perl version 5.42. For more information, read our Guide to Perl in cPanel - Perl Environments documentation.

Added WebPros Account for WHM logins

In cPanel & WHM version 132, we added the ability to use WebPros Account as an external authentication method in WHM’s Manage External Authentications interface (WHM » Home » Security Center » Manage External Authentications). This allows server administrators to log in to WHM with their WebPros Account credentials.

Added the ability to edit default DMARC records

In cPanel & WHM version 132, we added the ability to customize the default DMARC record using WHM API 1’s set_default_dmarc_record function. This allows for stricter email authentication policies and supports advanced DMARC options.

Enabled Interface Analytics automatically

In cPanel & WHM version 132, we fully remove personal, private, and security information from every step of analytics gathering. This change lets us automatically enable Interface Analytics, though we allow WHM administrators to make it optional. For more information, read our How to Allow Users to Manage Interface Analytics documentation.

Added in-product survey

In cPanel & WHM version 132, we added an in-product cPanel & WHM survey to gather data about how our customers use our product. Server administrators will see a pop-up survey window the first time they access WHM after the upgrade to cPanel & WHM version 132. cPanel and Webmail users will see the survey window the first time they access cPanel or Webmail after the upgrade.

Added custom search keyword support to WHM plugins

In cPanel & WHM version 132, we added support for custom WHM plugin search keywords. This change allows WHM administrators to customize search results so that users can find plugins more easily. For more information about how to manage custom search keywords, read our How to Manage WHM Plugin Search Keywords documentation.

Tightened permissions on the /etc/trueusersowners file

In cPanel & WHM version 132, we tightened the permissions on the /etc/trueuserowners file. This change prevents this file from being world-readable. This may cause errors, such as displaying incorrect contact information on the default CGI pages. To avoid these issues, we strongly recommend that you install the mod_suexec Apache module to handle your code.

For more information about this change, read our Best Practices for Code and Script Permissions documentation.

Added new notification settings

In cPanel & WHM version 132, we added a new notification for API token creation. We also added the root user to the change password notifications. You can adjust these notification settings in WHM’s Contact Manager interface (WHM » Home » Server Contacts » Contact Manager).

Added new Mailserver Configuration setting

In cPanel & WHM version 132, we added the Allow Weak Authentication Schemes setting in WHM’s Mailserver Configuration interface (WHM » Home » Service Configuration » Mailserver Configuration).

This setting allows the use of weak authentication hashing methods. This can be useful to allow users who use older password hashes to log in so they can change their passwords. We strongly recommend that you set your PAM configuration to use a stronger hashing scheme.

New UAPI functions

• InProductSurvey::get_in_product_survey_url — This function returns whether to display the cPanel & WHM product survey banner and link for a cPanel user.
• UserData::get_scoped_userdata — This function retrieves the userdata for a given scope and cPanel user.
• UserData::set_scoped_userdata — This function sets the userdata for a given scope and cPanel user.

New WHM API 1 functions

• get_default_dmarc_record – This function retrieves the server’s default DMARC record.
• set_default_dmarc_record – This function sets the server’s default DMARC record.
• get_in_product_survey_url — This function returns whether to display the cPanel & WHM product survey banner and link in WHM.
• get_scoped_userdata — This function retrieves the userdata for a given scope.
• set_scoped_userdata — This function sets the userdata for a given scope.
• has_features_like — This function allows you to search for cPanel account features and determine whether those features are enabled.
• list_features_like — This function allows you to search for enabled cPanel account features and lists those features in the returned payload.

Modified WHM API 1 functions

• get_service_config — We updated this function to support Dovecot 2.4.

Third-party application changes

For information on changes to our third-party applications, read our Third-Party Applications Updates documentation.

EasyApache 4 25.29

2025 September 24

Updated packages

We released updated packages for EasyApache 4.

This release includes an update to FreeTDS.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.28

2025 September 17

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to Tomcat 10.1 and NGHTTP2. It also includes security updates for NGINX and libcurl to address CVE-2025-53859 and CVE-2025-10148.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.8.2

2025 September 16

We published this maintenance release for bug fixes and security improvements. We also updated wp-cli to version 2.12.

EasyApache 4 25.27

2025 September 10

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to NodeJS 20, NodeJS 22, FreeTDS, and PHP 8.4.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.8.1

2025 September 09

We published this maintenance release with the following changes:

• We improved support for temporary domains.
• We added a link to purchase WP Guardian addon upgrades when the WP Guardian license limits are reached.
• We shortened the text of the Codeable Feature Showcase to make it more readable.
• We removed the duplicate Restore Point section for broken WordPress installations.

WP Toolkit 6.8.0

2025 August 21

Added support for AlmaLinux OS 10

You can now use WP Toolkit on AlmaLinux 10 servers.

Added support for temporary domains

WP Toolkit now supports temporary domains.

Enhanced Vulnerability Protection statistics

WP Toolkit now shows the number of attempts to exploit site vulnerabilities that Vulnerability Protection blocked.

Updated wording and keywords

We updated the wording and rearranged the grouping of controls for logic and consistency. We also added extra keywords to make finding WP Toolkit in the WHM interface easier.

EasyApache 4 25.26

2025 August 20

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to PHP 8.4, Memcached 1.6, Tomcat 10.1, NodeJS 22, LSAPI, and libcurl. It also includes security updates for NodeJS 20 and ModSecurity 2 to address CVE-2025-27210 and CVE-2025-54571.

For a full list of changes, read the EasyApache 4 change log.

Sitejet Builder version 4.2.0-1

2025 August 18

Fully Released the AI Website Generator

Sitejet Builder’s AI Website Generator is now out of beta. The AI Website Generator allows users to power their website design with AI in the Sitejet Website Builder (Content Management System). The AI generator will ask you a series of questions about your website, then create text and images for your website based on your answers. You can still make changes manually to your website if desired.

For more information, read cPanel’s Sitejet Builder documentation and the Sitejet Website Builder documentation.

EasyApache 4 25.25

2025 August 11

We released an updated package for EasyApache 4.

This release includes an update to Apache 2.4.

The Apache CVE fix in the EasyApache 25.24 release introduced stricter SNI handling. This change caused HTTP 421 errors in many reverse proxy setups. We reverted this update to give Apache and our team time to fix the issue. The latest Apache updates ensure compatibility, but we recommend that you confirm your CDNs and NGINX configurations in Plesk, cPanel, and WP Squared. For more information, read our Apache 2.4.65 Update support document.

Site Quality Monitoring 2.0.0-2

2025 August 7

Performance, usability, and stability improvements

We published a release for performance, usability, and stability improvements. For a full list of changes, read the Site Quality Monitoring change log.

EasyApache 4 25.24

2025 July 17

Security release

We released a security update for EasyApache 4.

This release includes security updates for Apache 2.4 to address CVE-2025-53020, CVE-2025-49812, CVE-2025-49630, CVE-2025-23048, CVE-2024-47252, CVE-2024-43394, CVE-2024-43204, and CVE-2024-42516.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.23

2025 July 16

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to Tomcat 10.1, Valkey, and NGINX NJS. It also includes security updates for Redis to address CVE-2025-32023 and CVE-2025-48367.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.7.3

2025 July 15

We published this maintenance release for bug fixes and improvements.

Sitejet Builder version 4.1.0-3

2025 July 10

Added AI Website Generator Availability to Sitejet Builder

The AI Website Generator adds AI website generation functionality to Sitejet Website Builder (Content Management System) website. The AI generator will ask you a series of questions about your website and generate text and images for your website based on your answers. You can still make changes manually to your website if desired.

This feature is in BETA and your hosting provider must enable this feature for it to be available.

For more information, read cPanel’s Sitejet Builder documentation and the Sitejet Website Builder documentation.

Modified WHM API 1 functions

• local_enable — We added the namespace parameter.
• local_disable — We added the namespace parameter.

EasyApache 4 25.22

2025 July 9

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to libtidy and NGINX headers more. It also includes security updates for ModSecurity 2, PHP 8.4, PHP 8.3, PHP 8.2, and PHP 8.1 to address CVE-2025-52891, CVE-2025-1735, CVE-2025-6491, and CVE-2025-1220.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.21

2025 July 2

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to NodeJS 20, NodeJS 22, FreeTDS, and NGHTTP2.

For a full list of changes, read the EasyApache 4 change log.

cPanel & WHM version 130

2025 July 2

Added temporary domains for cPanel accounts

In cPanel & WHM version 130, we added the ability to create a cPanel account with a temporary domain. This feature allows users to design and collaborate with others on a website without a registered domain.

You can create a cPanel account with a temporary domain in WHM’s Create a New Account interface (WHM » Home » Account Functions » Create a New Account). You can update the domain to use a registered domain in WHM’s Modify an Account interface (WHM » Home » Account Functions » Modify an Account).

To learn more about temporary domains, read our temporary domains documentation.

Added Change Password to Account Preferences

In cPanel & WHM version 130, we added the ability to update your account password to the Account Preferences interface (cPanel » Home » Preferences » Account Preferences).

Added Contact Information and Contact Preferences to Account Preferences

In cPanel & WHM version 130, we added the ability to update your contact information and contact preferences to the Account Preferences interface (cPanel » Home » Preferences » Account Preferences).

Added Update DNS Zone to Transfer Tool

In cPanel & WHM version 130, we added the ability to disable transferring DNS zonefiles when transferring an account in WHM’s Transfer Tool (WHM » Home » Transfers » Transfer Tool). This option is especially useful when performing a Live Transfer.

Added new option to the restorepkg Script

In cPanel & WHM version 130, we added the --update_dns_zone option to WHM’s /usr/local/cpanel/scripts/restorepkg script. This option allows you to disable transferring DNS zonefiles when you restore a cPanel account from a backup file.

Added new Tweak Setting to System

In cPanel & WHM version 130, we added the Size, in MB, for the /tmp partition secured by securetmp to the System section of WHM’s Tweak Settings interface (WHM » Home » Server Configuration » Tweak Settings). This setting allows you to set the amount of disk space that the user’s /tmp partition uses when securetmp is enabled.

Updated Apache logformat Default Settings in Global Configuration

In cPanel & WHM version 130, we updated the LogFormat (combined) and LogFormat (common) settings in WHM’s Global Configuration interface (WHM » Home » Service Configuration » Global Configuration). This changed the default Apache log format to use %a instead of %h.

Upgraded internal PHP

In cPanel & WHM version 130, we upgraded internal cPanel PHP from PHP 8.3 to PHP 8.4. This affects the cpsrvd service and third-party applications that use internal cPanel PHP, such as phpMyAdmin. For more information, read our cPanel PHP documentation.

Removed PHP Composer

In cPanel & WHM version 130, we removed PHP Composer. For more information, read our How to Set Up PHP Composer documentation.

New UAPI functions

• Domain::convert_temporary_to_registered — This function lets you convert a temporary domain to a registered domain.
• Domain::is_temporary_domain — This function returns whether a domain is a temporary domain.
• get_notification_preferences — This function lets you retrieve a cPanel or Webmail account’s notification preferences.
• set_notification_preferences — This function lets you change a cPanel or Webmail account’s notification preferences.
• ContactInformation::get_pushbullet_access_token — This function retrieves a cPanel account’s Pushbullet™ access token.
• ContactInformation::set_pushbullet_access_token — This function updates a cPanel account’s Pushbullet access token.
• Users::change_password – This function updates a cPanel account’s password.

Modified UAPI functions

• DomainInfo::domains_data — We added support for temporary domains.
• DomainInfo::list_domains — We added support for temporary domains.
• DomainInfo::main_domain_builtin_subdomain_aliases — We added support for temporary domains.
• DomainInfo::primary_domain — We added support for temporary domains.
• DomainInfo::single_domain_data — We added support for temporary domains.
• Email::list_mail_domains — We added support for temporary domains.
• WebVhosts::list_ssl_capable_domains — We added support for temporary domains.

Modified cPanel API 2 function

AddonDomain::addaddondomain — We added support for temporary domains.

Modified WHM API 1 functions

• accountsummary — We added support for temporary domains.
• listaccts — We added support for temporary domains.

Third-party application changes

For information on changes to our third-party applications, read our Third-party applications documentation

Server Monitoring alerts in the WHM Home interface

2025 June 24

We updated the WHM Home interface to contain Server Monitoring (Powered by 360 Monitoring) alerts in the Statistics panel and top navigation bar. These alerts let you know quickly about issues with your server’s resource use. For more information, read our The WHM Interface documentation.

WP Toolkit 6.7.2

2025 June 24

We published this maintenance release for bug fixes and improvements.

WP Toolkit 6.7.1

2025 June 20

We published this maintenance release for bug fixes and improvements.

WP Toolkit 6.7.0

2025 June 18

Filter out vulnerabilities

Server administrators can now filter out vulnerabilities for all sites on the server by adding the vulnerabilityAllowPrefix=CVE-PS- option to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file.

Centralized management and licensing via WP Guardian addon

Servers that use the WP Guardian addon can now connect to the wpguardian.com platform for centralized management and licensing across all servers. cPanel Partners also have access to Pay-as-you-go licensing for the WP Guardian addon across all servers. For more information, read our How to Purchase a WP Guardian (cPanel Addon) License documentation.

Run wp-cli commands in UI

Users can now run wp-cli commands directly in the WP Toolkit interface. For more information, read the Access WP-CLI section of our WP Toolkit documentation.

Delete existing data before restore

Users now have the option to delete existing website data before restoring a backup. For more information, read the Backing up and Restoring WordPress Installations section of our WP Toolkit documentation.

API operations on site settings

Users can now back up, restore, or clone site-specific settings via API. For more information, read our XML-API documentation.

New hooks for custom scripts

We added the following new hooks for running custom scripts:

• Vulnerability check completed.
• WordPress core updated.
• Plugin updated.
• Theme updated.

For more information, read the /usr/local/cpanel/3rdparty/wp-toolkit/var/user-hooks/README.md file. You can view this file in WHM’s Terminal interface (WHM » Home » Server Configuration » Terminal).

Custom directory for site backups

Server administrators can now set a custom directory to store all site backups via the customBackupsDirectory option in the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file.

Codeable integration

We added Codeable integration. Server administrators can configure or disable this integration in the Feature Showcase and can adjust the integration settings in the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file or global WP Toolkit settings. For more information, read the Updating the Hire a Developer Link section of our WP Toolkit documentation.

EasyApache 4 25.20

2025 June 18

Updated package and security release

We released an updated package for EasyApache 4.

This release includes an update to Tomcat 10.1, with security updates to address CVE-2025-48976, CVE-2025-48988, CVE-2025-49125, and CVE-2025-49124.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.19

2025 June 11

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to PHP 8.3, PHP 8.4, and libzip. It also includes a security update for libcurl to address CVE-2025-5399.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.18

2025 June 4

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to Ruby Rack and FreeTDS. It also includes security updates for ModSecurity® 2 and libcurl to address CVE-2025-47947, CVE-2025-48866, CVE-2025-5025, and CVE-2025-4947.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.17

2025 May 28

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to ModSecurity® NGINX® connector, Ruby Rack, NodeJS 22, and ionCube® 14.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.16

2025 May 21

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to Ruby Rack, Tomcat 10.1, and APR. It also includes security updates for NodeJS™ 20 and NodeJS 22 to address CVE-2025-23166, CVE-2025-23167, and CVE-2025-23165).

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.15

2025 May 14

Updated packages

We released updated packages for EasyApache 4.

This release includes updates to ModSecurity® 2, NGINX® NJS, Ruby Rack, PHP 8.4, and PHP 8.3.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.6.8

2025 May 12

Enabled and added hooks for custom scripts

By default, all WP Toolkit installations can now use hooks to run custom scripts after certain actions complete. We also added the following hooks:

• cloning finished.
• data copy finished.

For more information, read the /usr/local/cpanel/3rdparty/wp-toolkit/var/user-hooks/README.md file. You can view this file in WHM’s Terminal interface (WHM » Home » Server Configuration » Terminal).

EasyApache 4 25.14

2025 April 30

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to FreeTDS, NodeJS 20, NodeJS 22, Redis 6.2, and Ruby libuv. It also includes security updates for libxml2 and Valkey to address CVE-2025-32415, CVE-2025-32414, and CVE-2025-21605.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.13

2025 April 24

Updated packages

We released updated packages for EasyApache 4.

This release includes updated versions of PHP 8.3 and 8.4.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.12

2025 April 16

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of Phusion Passenger® and NGINX® NJS. It also includes a security update for Tomcat 10.1 to address CVE-2025-31651.

For a full list of changes, read the EasyApache 4 change log.

Sitejet Builder version 3.2.0-1

Released April 2024

Added Sitejet Domains interface

We added the Sitejet Domains interface to the Sitejet Builder feature. This updates the workflow for creating a Sitejet website. When you Create a New Website in the Sitejet Builder interface, the system redirects you to the Sitejet Domains interface. Before, the system redirected you to the Domains interface. For more information, read our Sitejet Builder interface documentation.

New UAPI functions

• Sitejet::can_create_domains - This function returns whether a cPanel account can create new subdomains or addon domains.

WP Toolkit 6.6.7

2025 April 04

We published this maintenance release for bug fixes and improvements.

EasyApache 4 25.11

2025 April 2

Updated packages

We released updated packages for EasyApache 4.

This release includes updated versions of NodeJS 18 and Memcached 1.6.

For a full list of changes, read the EasyApache 4 change log.

cPanel & WHM version 128

2025 March 27

Upgrade Blockers

None.

Updated Feature Manager options

In cPanel & WHM version 128, we updated the following Zone Editor options in WHM’s Feature Manager interface (WHM » Home » Packages » Feature Manager):

• Email Routing (MX Records and Zone Editor) – Enables cPanel’s Email Routing interface (cPanel » Home » Email » Email Routing) and allows users to view and edit MX records in cPanel’s Zone Editor interface (cPanel » Home » Domains » Zone Editor).
• Simple Zone Editor (Custom A and CNAME records only) – Enables cPanel’s Zone Editor interface (cPanel » Home » Domains » Zone Editor) and allows cPanel account users to create A and CNAME records.
• Advanced Zone Editor (All DNS records except MX) – Allows cPanel account users to create or modify AAAA, CAA, DMARC, SRV, and TXT records in cPanel’s Zone Editor interface (cPanel » Home » Domains » Zone Editor). This feature also controls whether a cPanel account user can view the existing default A and CNAME records.

For more information, read our Feature Manager documentation.

Added Change Language to Account Preferences

In cPanel & WHM version 128, we added the ability to change the language of your cPanel interface to the Account Preferences interface (cPanel » Home » Preferences » Account Preferences).

Deprecated the Change Language interface

In cPanel & WHM version 128, we deprecated the Change Language interface. To change the language for the cPanel interface, use the Account Preferences interface (cPanel » Home » Preferences » Account Preferences). For more information, read the cPanel Deprecation Plan.

Modified WHM API 1 functions

fetch_pkgacct_master_log — We updated cPanel & WHM’s version of the pigz binary and this function’s example path to the binary.

Third-party application changes

For information on changes to our third-party applications, read our Third-party applications documentation.

WP Toolkit 6.6.6

2025 March 25

We renamed the link that goes to the PHP Settings screen from Details to Modify.

EasyApache 4 25.10

2025 March 19

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updates to NodeJS 20 and libicu. It also includes security updates for PHP 8.1, 8.2, 8.3, and 8.4 to address CVE-2025-1736, CVE-2025-1861, CVE-2025-1734, CVE-2025-1217, CVE-2025-1219, and CVE-2024-11235.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.9

2025 March 12

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes security updates for Ruby Rack and Tomcat to address CVE-2025-27610 and CVE-2024-56337.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.8

2025 March 5

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of SourceGuardian and NGHTTP2. It also includes a security update for Ruby Rack to address CVE-2025-27111.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.6.5

2025 February 27

Display upsell prompts when Vulnerability Protection is not available

WP Guardian can now display upsell prompts to customers when the Vulnerability Protection feature is not available in their current hosting package. To display these prompts, set the showVirtualPatchesUpsellWhenRestrictedViaPlans option to true in the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file. You can also customize the upsell link via the whmVirtualPatchesUpsellUrl option in the file.

EasyApache 4 25.7

2025 February 26

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of Tomcat 10.1, NodeJS 18, Memcached 1.6, and a security update for Passenger to address CVE-2025-26803.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.6

2025 February 19

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of libcurl, SourceGuardian, Passenger, PHP 8.3, PHP 8.4, Ruby Rack, Ruby libuv, NGINX headers more, and a security update for libxml2 to address CVE-2025-24928 and CVE-2024-56171.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.5

2025 February 13

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of NodeJS 20, NodeJS 22, SourceGuardian, Passenger, Memcached 1.6, and security updates for libcurl, Tomcat 10.1, and NGINX to address CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2024-56337, and .

For a full list of changes, read the EasyApache 4 change log.

Search Engine Optimization 1.0.1

2025 February 3

We added the Search Engine Optimization interface (cPanel » Home » Domains » Search Engine Optimization) to cPanel & WHM. Users can now easily audit their websites to see how well they can be indexed by search engines like Google® and DuckDuckGo, helping users ensure their websites show up where they should in relevant searches.

Social Media Management 1.0.1

2025 February 3

Added Social Media Management feature

We added the Social Media Management feature, powered by SocialBee, to the cPanel interface. This feature lets you create, schedule, and reuse content across multiple social media platforms while ensuring consistent engagement. You also get detailed analytics to help you track performance and refine your social media strategy. For more information, read our Social Media Management (Powered by SocialBee documentation.

EasyApache 4 25.4

2025 January 29

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of Apache 2.4 and security updates for NodeJS 18, NodeJS 20, and NodeJS 22 to address CVE-2025-23083, CVE-2025-23084 and CVE-2025-23085.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.6.4

2025 January 24

We published this maintenance release for bug fixes and improvements.

EasyApache 4 25.3

2025 January 22

Updated packages

We released updated packages for EasyApache 4.

This release includes updated versions of PHP 8.3, PHP 8.4 and NGINX NJS.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 25.2

2025 January 15

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of libicu and NodeJS 22, and security updates for Valkey to address CVE-2024-46981 and CVE-2024-51741.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.6.3

2025 January 09

We renamed quarantined sites to unresponsive sites.

cPanel & WHM version 126

2025 January 8

New HTML Editor

In cPanel & WHM version 126, we added a new HTML Editor to cPanel’s File Manager interface (cPanel » Home » Files » File Manager). This modern, feature-rich editor provides users with an improved editing experience, better performance, and more formatting options.

Added Web Log Retention interface

In cPanel & WHM version 126, we added WHM’s Web Log Retention interface (WHM » Account Functions » Web Log Retention). This interface displays web server log retention settings for all cPanel accounts on your server.

Automatically enabled Interface Analytics

In cPanel & WHM version 126, we fully removed personal, private, and security information from every step of analytics gathering. We automatically install and enable the Interface Analytics plugin and disable the Interface Analytics options in the cPanel, WHM, and Webmail interfaces unless we cannot retrieve a user’s analytics configuration. For more information, read our cPanel Analytics documentation.

To reenable Interface Analytics options, read our How to Allow Users to Manage Interface Analytics documentation.

Added MySQL 8.4

In cPanel & WHM version 126, we added support for MySQL® 8.4 on servers that run AlmaLinux OS 8, CloudLinux™ 8, RockyLinux™ 8, and Ubuntu® 22. For information about supported versions of MySQL, read our Supported MySQL/MariaDB Versions documentation.

Removed support for Apple iOS push notifications

In cPanel & WHM version 126, we removed support for Apple® iOS® push notifications. We removed the iOS Push Notifications tab from WHM’s Manage Service SSL Certificates interface (WHM » Service Configuration » Manage Service SSL Certificates) and the APNSPush service from WHM’s Service Manager interface (WHM » Service Configuration » Service Manager). For more information, read our cPanel Deprecation Plan documentation.

Removed Python 2

In cPanel & WHM version 126, we removed support for Python 2, which has reached its EOL (End of Life). As part of this removal, we updated the Mailman application to use Python 3 instead of Python 2. For more information, read our cPanel Deprecation Plan documentation.

Added Server Monitoring to the Feature Showcase

Server Monitoring (Powered by 360 Monitoring) now appears in the Feature Showcase interface.

Removed Account Type selection

In cPanel & WHM version 126, we removed the option to select Account Type in the Consent and Privacy section of cPanel’s Account Preferences interface (cPanel » Home » Preferences » Account Preferences).

New WHM API 1 functions

• EcosystemFeatures-local_enable — This function allows you to locally enable a plugin-based feature.
• EcosystemFeatures-local_disable — This function allows you to locally disable a plugin-based feature.
• EcosystemFeatures-is_ready — This function checks if a plugin-based feature is installed and ready for use on the server.
• list_accounts_retention — This function lists the web server log retention settings for all accounts on the server.

Modified WHM API 1 functions

• install_service_ssl_certificate — Removed the mail_apns service.
• reset_service_ssl_certificate — Removed the mail_apns service.

New UAPI functions

• LogManager::delete_archive — This function deletes a log archive file from a cPanel user’s logs directory.

Modified UAPI functions

• CPDAVD::list_users — Added support for task lists.
• CPDAVD::manage_collection — Added support for task lists.
• LogManager::get_settings — Added support for the server default log file retention period.
• LogManager::set_settings — Added support for the number of days to keep log files.

New scripts

• /usr/local/cpanel/scripts/log_retention — This script manages log file retention for cPanel & WHM logs.

Third-party application changes

For information on changes to our third-party applications, read our Third-party applications documentation.

EasyApache 4 25.1

2025 January 8

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of PHP 8.2, PHP 8.3, PHP 8.4, Memcached 1.6, Onigurama, QOS, and security updates for Redis to address CVE-2024-46981.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.6.2

2024 December 19

Added email-notification settings to wp-toolkit command

You can now list email-notification settings with the wp-toolkit --config -operation list command. For more information, read our wp-toolkit: WP Toolkit documentation.

EasyApache 4 2024.12.18

2024 December 18

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes updated versions of NodeJS 22, Memcached 1.6, NGINX NJS and security updates for libcurl and Tomcat 10.1 to address CVE-2024-11053, CVE-2024-54677 and CVE-2024-50379.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.6.1

2024 December 12

Run custom scripts

We added the ability to run custom scripts after certain actions, such as installing a set. To enable this feature, add the exposeEventsFeature = true option to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file. For more information, read the /usr/local/cpanel/3rdparty/wp-toolkit/var/user-hooks/README.md file. You can view this file in WHM’s Terminal interface (WHM » Home » Server Configuration » Terminal).

EasyApache 4 2024.12.4

2024 December 4

New and updated packages

This release includes the initial release of PHP 8.4 and an updated version of Pear.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.6.0

2024 November 26

Improvements to Vulnerability Protection

We made the following improvements to the Vulnerability Protection feature:

• We added widgets to the WordPress Vulnerabilities interface that help site administrators address the most important issues first, including the number of vulnerabilities that the Vulnerability Protection feature blocked.
• The site card header now includes an icon that shows the vulnerability protection status for easier identification and management.
• We added the Vulnerability Protection API.
• We added a vulnerability-protection license type for 50 sites.
• We improved the vulnerability labels and moved them to a more visible location in the interface.
• We greyed-out addressed vulnerabilities and moved them to a different location in the interface.
• We now indicate vulnerabilities in inactive themes.

Set custom subdomain in Smart PHP Update API

You can now set a custom subdomain name for a website clone via the Smart PHP Update API. For information on cloning websites, read the Cloning a WordPress Website section of our WP Toolkit documentation.

Disable password-change email notifications

We added the option to disable the email notifications that WordPress® sends about password changes. To disable these notifications, add the sendWordPressPasswordChangedNativeEmail = false option to the /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file.

EasyApache 4 2024.11.25

2024 November 25

Updated packages and security release

We released updated packages for EasyApache 4.

This release includes an updated version of NodeJS 20 and security updates for PHP 8.1, 8.2, and 8.3 to address CVE-2024-11233, CVE-2024-11234, CVE-2024-11236, CVE-2024-8929, and CVE-2024-8932.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 2024.11.20

2024 November 20

Updated package and security release

We released an updated package for EasyApache 4.

This release includes a security update for Tomcat 10.1 to address CVE-2024-52316, CVE-2024-52317, and CVE-2024-52318 and updated versions of libxml2 and NodeJS 18.

For a full list of changes, read the EasyApache 4 change log.

Site Quality Monitoring

2024 November 16

Site Quality Monitoring adds crawl depth options

Users can now crawl at specific depths. This allows users to quickly check a website for issues if they don’t want to dedicate the time for a more in-depth crawl.

EasyApache 4 2024.11.13

2024 November 13

Updated package and security release

We released an updated package for EasyApache 4.

This release includes a security update for libcurl to address CVE-2024-9681.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 2024.11.6

2024 November 6

Updated packages

We released updated packages for EasyApache 4.

This release includes updated versions of OWASP ModSecurity CRS, libzip, and NodeJS 22.

For a full list of changes, read the EasyApache 4 change log.

Sitejet Builder version 1.6.0

2024 November 5

New WHM API 1 functions

• get_commerce – This function returns Sitejet Commerce data.
• set_commerce – This function enables Sitejet Commerce for all users and allows the hosting provider to set a custom URL for their payment platform, which customers can use to purchase the Sitejet Commerce upgrade.

Deprecated API 1 functions

• get_ecommerce – We renamed this function get_commerce.
• set_ecommerce – We renamed this function set_commerce.

EasyApache 4 2024.10.30

2024 October 30

New and updated packages

We released new and updated packages for EasyApache 4.

This release includes the initial release of ionCube 14 and updated versions of Memcached, PHP 8.2, PHP 8.3, NGHTTP2, NodeJS 22, and NGINX NJS.

For a full list of changes, read the EasyApache 4 change log.

Server Monitoring (Powered by 360 Monitoring) version 1.0

2024 October 29

Added the Server Monitoring panel to the WHM interface

In cPanel & WHM version 118, we added the Server Monitoring section to the WHM interface. The Server Monitoring section displays statistics and metrics for your server’s performance at a glance. Here you can see details such as CPU Usage, Load Averages, Top Processes and more. For a more detailed view, click View Reports to be taken to the Server Monitoring (Powered by 360 Monitoring interface (WHM » Plugins » Server Monitoring).

Added the Server Monitoring (Powered by 360 Monitoring) interface

We added the Server Monitoring interface (WHM » Plugins » Server Monitoring) to cPanel & WHM. The Server Monitoring (powered by 360 Monitoring) interface provides real-time insights into the performance, availability, and health of your websites, servers, and applications. It tracks key metrics like uptime, response times, and server resources to spot issues before they affect users. This interface helps businesses maintain optimal performance by providing clear reports and alerts, allowing them to fix problems quickly.

EasyApache 4 2024.10.16

2024 October 16

Updated packages

We released an updated package for EasyApache 4.

This release includes an updated version of Ruby Rack.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.5.4

2024 October 11

We published this release for security improvements.

EasyApache 4 2024.10.9

2024 October 9

Updated packages and security update

We released updated packages for EasyApache 4.

This release includes security updates to Redis version 6.2.16 to address CVE-2024-31449 and CVE-2024-31228. It also includes updated versions of Valkey, NGINX NJS, NodeJS and reverts libuv to the previous version of 1.48.0.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 2024.10.2

2024 October 2

Updated packages and security update

We released updated packages for EasyApache 4.

This release includes security updates to PHP versions 8.1, 8.2, and 8.3 to address CVE-2024-9026, CVE-2024-8925, CVE-2024-8926 and CVE-2024-8927. It also includes updated versions of Valkey, NGINX headers more, and libuv.

For a full list of changes, read the EasyApache 4 change log.

cPanel & WHM version 124

2024 October 1

Added account type to cPanel Analytics

In cPanel & WHM version 124, we added an option to select account type to the cPanel Analytics consent form. The new form prompts users to select either an individual or business account. For more information, read our cPanel Analytics documentation.

MariaDB® 11.4 support added

In cPanel & WHM version 124, we added support for MariaDB 11.4. If your server uses MariaDB for its database server, MariaDB 11.4 now appears as an option in WHM’s Upgrade Database Version interface (WHM » Home » Database Services » Upgrade Database Version). For information about changes to MariaDB in version 11.4, read MariaDB’s Changes and Improvements in MariaDB 11.4 documentation.

Improved DMARC support

In cPanel & WHM version 124, we improved our support for DMARC. We added the ability for server administrators to apply a default DMARC policy to the server’s domains. We also made it easier for cPanel users to manage their domains’ DMARC records.

As part of our improved support, we made the following changes:

• Enabled the Advanced Zone Editor by default — When your server updates to cPanel & WHM version 124, the Feature Showcase interface displays the Enable Advanced Zone Editing for Improved DMARC Support option. When you select this option, the system enables the Zone Editor (AAAA, CAA, DMARC, SRV, TXT) feature in WHM’s Feature Manager interface (WHM » Home » Packages » Feature Manager) for all feature lists with the Zone Editor (A, CNAME, MX) feature enabled.

  Important:

  We strongly recommend that you enable this option. If you do not enable this option, your users may not be able to manage their DMARC records.

  On new installations of cPanel & WHM version 124, the system automatically enables the Zone Editor (AAAA, CAA, DMARC, SRV, TXT) feature for the default feature list in WHM’s Feature Manager interface (WHM » Home » Packages » Feature Manager).

• Added a new interface for server-wide DMARC records — We added WHM’s Email DNS Record Manager interface (WHM » Home » DNS Functions » Email DNS Record Manager). This interface allows you to apply a default DMARC policy to your server’s domains.

• Added DMARC to Email Deliverability — We added the ability to add a default DMARC policy to WHM’s Email Deliverability interface (WHM » Home » Email » Email Deliverability) and cPanel’s Email Deliverability interface (cPanel » Home » Email » Email Deliverability).

• Added DMARC to Create a New Account and Modify an Account — We added DMARC support to WHM’s Create a New Account interface (WHM » Home » Account Functions » Create a New Account) and WHM’s Modify an Account interface (WHM » Home » Account Functions » Modify an Account). To add a default DMARC policy to domains on a new or modified account, select the Enable DMARC on this account. checkbox in the DNS Settings section of the corresponding interface.

New UAPI functions

• EmailAuth::apply_dmarc — This function applies a DMARC policy to a user’s domain or domains.
• EmailAuth::remove_dmarc — This function removes a DMARC policy from a user’s domain or domains.
• EmailAuth::validate_current_dmarcs — This function validates a DMARC policy for a user’s domain or domains.

New WHM API 1 functions

• apply_dmarc — This function applies a DMARC policy to a domain or domains.
• remove_dmarc — This function removes a DMARC policy from a domain or domains.
• validate_current_dmarcs — This function validates a DMARC policy for a domain or domains.
• twofactorauth_get_tfa_config_for_user — This function allows a root user or a reseller account with All Features privileges to retrieve a cPanel user’s two-factor authentication configuration, including the configuration for email accounts and team users.
• twofactorauth_set_tfa_config_for_user — This function allows a root user or a reseller account with All Features privileges to set a cPanel user’s two-factor authentication configuration, including the configuration for email accounts and team users.

Modified UAPI functions

• Backup::fullbackup_to_homedir — Added the integrationlinks option.

Modified WHM API 1 functions

• createacct — Added the dmarc option.
• modifyacct — Added the HASDMARC option.
• massmodifyacct — Added the HASDMARC option.

Modified scripts

• /usr/local/cpanel/scripts/pkgacct — Added the --skipcustomdmarc option.
• /usr/local/cpanel/scripts/convert_roundcube_mysql2sqlite — Added restoration for the responses table.

Third-party application changes

For information on changes to our third-party applications, read our Third-party applications documentation.

EasyApache 4 2024.9.25

2024 September 25

Updated packages

We released updated packages for EasyApache 4.

This release includes updated versions of NodeJS 22, Tomcat 10.1, libcurl, libxml2, PHP 8.2, and PHP 8.3 .

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 2024.9.18

2024 September 18

Updated packages and security update

We released updated packages for EasyApache 4.

This release includes a security update to libcurl to address CVE-2024-8096 and updated versions of libxml2, Pear, and ionCube 13.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 2024.9.5

2024 September 5

Updated packages

We released updated packages for EasyApache 4.

This release includes updated versions of NGHTTP2 and NodeJS 22 and support for PHP 8.3 with SourceGuardian.

For a full list of changes, read the EasyApache 4 change log.

EasyApache 4 2024.8.29

2024 August 29

Updated packages and security update

We released updated packages for EasyApache 4.

This release includes a security update to APR to address CVE-2023-49582 and updated versions of NodeJS 20 and NodeJS 22.

For a full list of changes, read the EasyApache 4 change log.

WP Toolkit 6.5.3

2024 August 21

We published this maintenance release for bug fixes and improvements.

Sitejet Builder version 1.5.0

2024 August 7

Updated French translations

We added an improved set of French translations. This will provide a better experience for users who prefer French.

WP Toolkit 6.5.2

2024 July 31

We published this maintenance release for bug fixes and improvements.

Sitejet Builder version 1.4.1-2

2024 July 30

Added ability to enable and disable Sitejet Commerce

We added the ability for hosting providers to enable and disable Sitejet Commerce using WHM’s get_ecommerce and set_ecommerce functions. Sitejet Commerce allows users to create, design, and manage a store on their website.

New WHM API 1 functions

• get_ecommerce – This function returns Sitejet Commerce data.
• set_ecommerce – This function enables Sitejet Commerce and sets the URL for the store.

WP Toolkit 6.5.1

2024 July 18

We published this maintenance release for bug fixes and improvements.

WP Toolkit 6.5.0

2024 July 17

WP Guardian Vulnerability Protection for single WordPress sites

You can now purchase the WP Guardian addon with Vulnerability Protection for individual WordPress sites.

• Users can purchase this addon for any WordPress site they can access in WP Toolkit.
• The single-site WP Guardian addon does not include other Deluxe features like Smart Updates or Smart PHP Updates.
• Sites that use this addon do not count toward the WordPress websites with Vulnerability Protection limit in the WP Toolkit package extension.
• The ability for users to buy this addon cannot be restricted via the WordPress websites with Vulnerability Protection setting in the WP Toolkit package extension.
• If a server-level WP Guardian addon license is already present on the server, the system disables the ability to buy a single-site addon.
• To enable purchasing of this addon, add the following option to your server’s /usr/local/cpanel/3rdparty/wp-toolkit/var/etc/config.ini file:

  [ext-wp-toolkit]
  virtualPatchesLicensingForEndCustomers = true 

• We will release this addon selectively and gradually so that server administrators have enough time to disable it, if needed.

Added new rank for active exploited vulnerabilities

Actively exploited vulnerabilities now have their own Critical risk rank.

Other changes

• Codeable integration now tracks server ownership for the upcoming affiliate program.
• WP Toolkit now greys-out addressed vulnerabilities to help users focus on non-addressed ones.
• If you try to enable Vulnerability Protection without first adding it to a package, you will see a message that tells you to enable Vulnerability Protection.

WP Toolkit 6.4.0

2024 June 11

New Vulnerability Protection feature

We added the Vulnerability Protection feature to WP Guardian. Vulnerability Protection is a security feature for WordPress websites that provides a simple, automated way to neutralize vulnerabilities in WordPress plugins, themes, and core.

Once you enable Vulnerability Protection on a site, the feature automatically neutralizes high-risk and medium-risk vulnerabilities. By default, the feature ignores low-risk vulnerabilities.

• When you enable Vulnerability Protection, the system installs a WordPress plugin that applies special protection rules. These protection rules work like a firewall and do not touch or modify the site code. The plugin applies and removes the protection rules only for specific vulnerabilities on the given site, so the rules have minimal impact on site performance.
• The Vulnerability Protection feature and its corresponding upsell prompts are not visible to users by default. The server administrator can control access to this feature via a separate limit in the user’s package.
• The Vulnerability Protection feature is a part of the WP Guardian security suite. You must purchase a separate WP Guardian addon license to get this feature.

Customize the “Hire a developer” link

We added the ability to either change the destination of the “Hire a developer” link or to hide it completely in the global WP Toolkit settings. For more information, read the Updating the Hire a Developer Link section of our WP Toolkit documentation.

Automatically provision WordPress and sets

Server administrators can now automatically provision WordPress and its sets for cPanel accounts. To do this, select the Autoinstall WordPress upon account creation checkbox, then select the set to install in the Autoinstall Set menu for the WP Toolkit package extension in WHM’s Edit a Package interface (WHM » Home » Packages » Edit a Package).

cPanel & WHM version 122

2024 July 9

Added ALIAS DNS record support

In cPanel & WHM version 122, we added experimental support for the ALIAS DNS record to WHM’s DNS Zone Manager interface (WHM » Home » DNS Functions » DNS Zone Manager) and cPanel’s Zone Editor interface (cPanel » Home » Domains » Zone Editor). This record only works on systems that run PowerDNS.

For more information about ALIAS DNS records, read our The ALIAS DNS Record documentation.

Experimental ARC support in Exim

In cPanel & WHM version 122, we added experimental support for in Exim. For more information, read our Exim Configuration Manager Basic Editor documentation.

Tomcat Manager removal

In cPanel & WHM version 122, we removed WHM’s Tomcat Manager interface, as it managed Tomcat 8.5, which is deprecated. Instead, use Tomcat 10.1 with containers.

Removed MySQL Manager

We removed cPanel’s MySQL® Manager interface. For more information, read our cPanel Deprecation Plan documentation.

MariaDB the default database management system

When you install cPanel & WHM, it now installs MariaDB® 10.11 by default in version 122 and later. To use MySQL or a different version of MariaDB instead, you may customize your installation or upgrade your database version. For more information about what database versions you can use, read our Supported MySQL/MariaDB Versions documentation.

Older Roundcube database versions converted to SQLite

When your server updates to cPanel & WHM version 122, if Roundcube uses either MySQL version 5.6 or below or MariaDB 10.0, the system will convert the Roundcube database to individual SQLite databases. The system will also update Roundcube to version 1.6.

New UAPI functions

• DNS::is_alias_available — This function returns whether the ALIAS DNS record is enabled.

New WHM API 1 functions

• is_alias_available — This function returns whether the ALIAS DNS record is enabled.

Removed Tomcat 8.5 functions

The following functions dealt with Tomcat 8.5, which is deprecated:

• ea4_tomcat85_rem
• ea4_tomcat85_add
• ea4_tomcat85_list

Removed scripts

• /usr/local/cpanel/scripts/check_cpanel_rpms – We removed the /usr/local/cpanel/scripts/check_cpanel_rpms script. Use the /usr/local/cpanel/scripts/check_cpanel_pkgs script instead.

Third-party application changes

For more information changes to our third-party applications, read our Third-party applications documentation.