cPanel’s EasyApache and PHP Selector build or install PHP beside the operating system packages. dnf update php can report nothing to do while the public site still uses ea-php74.
What to look at
In WHM, MultiPHP Manager shows the PHP version per vhost. The binary is typically under /opt/cpanel/ea-phpXX. That path is what you version-check. AlmaLinux or Ubuntu fixes do not automatically refresh ea-php packages.
Remediation
Apply cPanel’s PHP update for each ea-php version a vhost uses, then restart the PHP-FPM pools cPanel manages. This review did not record a cPanel build number, so the authoritative note is cPanel’s changelog for these CVEs. Sites pinned to 5.6 or 7.x need a vendor build or a selector change after plugin tests.
Nginx or Apache in front of cPanel is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating cPanel fix PHP2Shell?
No. cPanel runs on PHP. The PHP binary or package that serves it has to be patched or replaced.