How to change the PHP version in cPanel and WHM

For WHM administrators

Install the fixed PHP builds in WHM

EasyApache 4 installs only cPanel-provided PHP, packaged as ea-php##, with one package set per PHP version and its own php.ini at /opt/cpanel/ea-php##/root/etc/php.ini. New patch releases arrive as package updates, so the work is installing updates and restarting PHP.

1. See what the server has now

# Every EasyApache 4 PHP package on the server, with its version
rpm -qa | grep -i ea-php

# On Ubuntu-based cPanel servers, list them with dpkg instead
dpkg-query -W 'ea-php*'

# Ask one PHP version which patch release it is (PHP 8.3 shown)
/usr/local/bin/ea-php83 -v

cPanel documents /usr/local/bin/ea-php## as the command-line PHP for each version. Repeat the last command for every version listed. Anything below the release in the table above still needs the update.

2. Install the package updates

In WHM, open Home > Software > System Update, or follow the Run system update link at the top of EasyApache 4. System Update updates all of the server's RPM packages, ea-php included. Leave Include kernel packages clear unless you are ready for a reboot, which a kernel update may need, then click Proceed.

On an Ubuntu-based cPanel server the ea- packages are managed with apt, as cPanel's own extension instructions show, so apt update followed by apt upgrade brings them up to date.

3. Restart PHP-FPM and Apache

# Restart PHP-FPM, then Apache, so no worker keeps the old build
/usr/local/cpanel/scripts/restartsrv_apache_php_fpm --restart
/usr/local/cpanel/scripts/restartsrv_httpd --restart

cPanel's restartsrv scripts accept --restart for a soft restart and --hard for a full stop and start. PHP-FPM workers keep running the code they started with until they are replaced, so do not skip this step.

4. Add a newer PHP version if domains need one

Open Home > Software > EasyApache 4, click Customize on the current profile and click Next through the MPM and Apache module steps to PHP Versions. Select the version. EasyApache 4 offers to bring across the extensions your other versions use (PHP ## and Extensions), the version alone (PHP ## only), or an Edit list. Carry on to Review, click Provision, then Done. Note that cPanel's default profile includes PHP 8.1 and 8.2, both close to or past the end of their support.

5. Move domains off old branches

In Home > Software > MultiPHP Manager, the User Domain Settings tab lists every domain with its account, version and PHP-FPM status. Tick several domains and use Set PHP Version to move them together. On the System Settings tab, the PHP Version menu sets the version for new accounts and for existing ones that inherit; choosing a deprecated version asks you to confirm with Apply Deprecated Version.

6. Stop the next fix waiting for you

cPanel recommends updating packages whenever a new EasyApache update is released, and suggests setting Operating System Package Updates to Automatic in Update Preferences, or having root apply them by hand or on a schedule. Either way, a restart of PHP is what puts the new build into service.

Confirm it worked

Confirm the change worked

A tidy MultiPHP Manager screen proves which branch is selected. It does not prove the patch release, or that the old workers have gone.

1. 1. Re-open MultiPHP Manager. The domain should show the version you chose, without the Inherited label if you picked a specific version.
2. 2. Read the full number through the website. WordPress shows it in Site Health. On other sites, a phpinfo() file uploaded for a minute and then removed does the same job. Look for 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. How to check your PHP version.
3. 3. Administrators: check each installed version from the shell. Run /usr/local/bin/ea-php## with -v for every version, and see what a domain is set to with:

   # The PHP version WHM has recorded for one domain
   grep phpversion /var/cpanel/userdata/USERNAME/DOMAIN

4. 4. For PHP 8.1, 8.0 and 7.4, read the change log, not the number.

   # ea-php81, ea-php80 and ea-php74 keep their old version numbers,
   # so look for the two CVE IDs in each package's change log instead
   for p in $(rpm -qa | grep -i ea-php81); do
     echo "$p"
     rpm -q --changelog "$p" | grep -E 'CVE-2026-10961(8|9)'
   done

   Change ea-php81 to ea-php80 or ea-php74 as needed. If no CVE line appears, compare the installed package versions with cPanel's change log before assuming the server is fixed.
5. 5. Check for compromise if the site was exposed. CISA has listed both flaws as known to be exploited since 26 October 2026. Patching stops new attacks; it does not remove anything planted before it. Has your PHP site been compromised?