We have released updated PHP versions in EMPS packages and Enduser / Customer facing PHP in Webuzo to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619.
We have launched PHP 5.6 to 8.5 with patches that fix the critical bugs in PHP.
EMPS 5.6 has been updated to PHP 7.4 with the security patches.
We recommend that all Webuzo users update EMPS and all PHP to ensure they receive the patched packages.
Update EMPS
To update EMPS to the patched version, execute the following command as the root user on your server:
webuzo --emps update
The command will initiate the EMPS update process and download the available patched packages.
Verify that the build date is 21st Oct, 2026 and later :
/usr/local/emps/bin/php -v
Update Enduser / Customer Facing PHP
To update all PHP of the enduser / customers, the following command will download and update the packages :
/usr/local/emps/bin/php /usr/local/webuzo/cron.php debug=2
HOWEVER, if Auto Updates was off you will need to update via the Admin Panel -> Update Apps
OR run the following as per installed PHP :
webuzo --updateapp app=php56 --force=1
webuzo --updateapp app=php70 --force=1
webuzo --updateapp app=php71 --force=1
webuzo --updateapp app=php72 --force=1
webuzo --updateapp app=php73 --force=1
webuzo --updateapp app=php74 --force=1
webuzo --updateapp app=php80 --force=1
webuzo --updateapp app=php81 --force=1
webuzo --updateapp app=php82 --force=1
webuzo --updateapp app=php83 --force=1
webuzo --updateapp app=php84 --force=1
webuzo --updateapp app=php85 --force=1
Verify that the build date is 21st Oct, 2026 and later :
find /usr/local/apps/ -wholename '/usr/local/apps/php*/bin/php' -exec echo "=== {} ===" \; -exec {} -v \;
Recommendation:
We strongly recommend running the update command as soon as possible to ensure your server has the latest available EMPS and PHP patches addressing these vulnerabilities.
For further assistance, please contact the Webuzo support team.