# changelog

author: Sergey Fokin <sfokin@cloudlinux.com> - 6.1.2-3
changelog:
  - create /opt/alt/ruby27/share/passenger/node <- /opt/alt/ruby27/share/passenger/src/nodejs_supportlib
    symlink to fix working with nodejs


author: Dan Muey <daniel.muey@webpros.com> - 2.4.64-3
changelog:
  - EA-13041: Rolling “ea-apache24” back to “35b37d6c7295199c5157c68145f220d9fa61ff02”: Apache v2.4.64 broke SNI (rando 421)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.66-1
changelog:
  - EA-13281: Update ea-apache24 from v2.4.65 to v2.4.66
  	- low: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)
  	- low: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)
  	- moderate: Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVE-2025-59775)
  	- low: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  	- moderate: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-1
changelog:
  - EA-13423: Update ea-apache24 from v2.4.66 to v2.4.67
  	- important: Apache HTTP Server: http2: double free and possible RCE on early reset (CVE-2026-23918)
  	- moderate: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr (CVE-2026-24072)
  	- moderate: Apache HTTP Server: mod_auth_digest timing attack (CVE-2026-33006)
  	- low: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header() (CVE-2026-28780)
  	- low: Apache HTTP Server: mod_md unrestricted OCSP response (CVE-2026-29168)
  	- low: Apache HTTP Server: mod_dav_lock indirect lock crash (CVE-2026-29169)
  	- low: Apache HTTP Server: mod_authn_socache crash (CVE-2026-33007)
  	- low: Apache HTTP Server: multiple modules HTTP response splitting (CVE-2026-33523)
  	- low: Apache HTTP Server: off-by-one OOB reads in AJP getter functions (CVE-2026-33857)
  	- low: Apache HTTP Server: mod_proxy_ajp heap buffer over-read in ajp_msg_get_string (CVE-2026-34032)
  	- low: Apache HTTP Server: mod_proxy_ajp heap over-read in ajp_parse_data() (CVE-2026-34059)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.67-3
changelog:
  - EA-13454: Backport mod_http2 v2.0.41 fix for CVE-2026-49975 (HTTP/2 Bomb - cookie LimitRequestFields bypass)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Nika Keshelava <nkeshelava@cloudlinux.com> - 1.0-46
changelog:
  - CLOS-3754: fix SIGSEGV in process_lve_error() when mod_brotli is loaded
  - CLOS-4441: Maintenance update
  - CLOS-4585: Maintenance update


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-15
changelog:
  - suPHP_UserGroup processing
  - fixed cPanel's install script
  - extended debug_enabled mode fix
  - LVE entering removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-17
changelog:
  - Server config merging
  - Default value of lsapi_pgrp_max_idle is changed
  - Handler to Backend dir is moved into the library


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-39
changelog:
  - Added secret file installation
  - Fixed hook for patching cPanel templates
  - sulsphp signs
  - sulsphp parent check


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-42
changelog:
  - Using Apache or apr random function instead of /dev/random
  - Processing internal redirects
  - Spec fixes
  - Fixed installation scripts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-51
changelog:
  - Error 404 in the case of script absense
  - Script owner and permission checks
  - Full support for lsapi_phprc


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-53
changelog:
  - Added lsapi_target_perm config parameter
  - Fixed NULL server-var bug
  - Logging backend fatal error log
  - Fixed DA directory name


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-54
changelog:
  - Added lsapi_uid_gid config parameter
  - Added lsapi_use_default_uid config parameter
  - uid/gid params moved to dir config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-58
changelog:
  - Hook removed
  - Defaults for lsapi_backend_connect_timeout and lsapi_backend_connect_tries changed
  - lsapi_user_group added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-68
changelog:
  - Timeout for backend poll added
  - Backend poll redesign
  - PHP ENV modify_type fix
  - lsapi_hostname_on_debug parameter added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-69
changelog:
  - Delayed invoke mode added
  - read/write/poll backend refined
  - Log messages on error conditions added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-71
changelog:
  - TMPDIR, TEMP and TMP added into safe env var list
  - Dump headers always option is added into config
  - Debug data exchange config option added
  - Dealing with REDIRECT_STATUS added (MODLS-11 fix)
  - Fixed DA install script
  - Resending request if lsphp crash or reset connection added (MODLS-12 fix)
  - Send 503 code in the case of lsphp killing (MODLS-13 fix)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-77
changelog:
  - lsapi_mutex_mech option added
  - send_data simplified
  - cagefs mp fix
  - audit fixes
  - 401 redirect fix
  - 503 response when lsphp is killed
  - REDIRECT_STATUS fix
  - TMPDIR, TEMP and TMP added into safe env var list


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-84
changelog:
  - RPM spec fix
  - Added mod_lsapi rebuild into after_apache_make_install hook
  - 302 Moved Temporarily instead of 302 Found
  - Chrome 302 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-90
changelog:
  - lsapi_do_request redesign
  - lsphp response code used
  - PHP error pages displayed
  - Fatal error log processed correctly
  - Fix 500 Internal server error on 200 Ok page


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-91
changelog:
  - lsapi_backend_children changed to 80
  - Starter pid log output added
  - sulsphp_log location for DA changed
  - selfstarter mode always enabled
  - Log request_rec on send_request error
  - Some advices to error log added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-98
changelog:
  - Default value for lsapi_use_default_uid changed to On
  - nobody and apache added as exception to sulsphp


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-1
changelog:
  - Add disabling php_* directives processing
  - sulsphp moved into library
  - ACCEPT_NOTIFY mode implemented
  - Deprecated methods removed
  - Connection pool mode implemented
  - lsapi_backend_max_idle and lsapi_backend_max_reqs parameters added
  - Default lsapi_socket_path changed
  - Added build lsphp with custom php sources location
  - Added hook for autobuild lsphp on easyapach rebuild
  - Creation of subdirectories for socket dir added
  - Fix for custom path lsphp build
  - Old mod_lsapi src.rpm generated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-4
changelog:
  - use_suexec option implemented
  - lsapi_check_document_root option implemented
  - Fix mod_lsapi release number in rpm spec
  - Fix path of php source detection on cPanel
  - Fixed php.ini for correct php work on cPanel
  - Precise Requires: tags in rpm specs
  - Fix for compilation flags for sulsphp in CMakeLists


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-12
changelog:
  - lsapi_backend_accept_notify related bug fix
  - mod_lsapi archive for OBS mode added
  - EA4 package scripts added
  - X-Accel-Buffering: no header support added
  - gdb and lsof removed from mod_lsapi rpm deps
  - Default value for lsapi_accept_notify option changed to On


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-15
changelog:
  - MODLS61: Server-Sent Events support added
  - lsapi_paranoid option added
  - MODLS21: Auto value for lsapi_phprc option added
  - MODLS62: lsapi_max_connection option implemented


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-16
changelog:
  - Merging with_connection_pool CRIU branch
  - Fix for OBS
  - MODLS70: X-Powered-By related fix
  - secret file size fix
  - TMP and TEMP env vars added into default config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-17
changelog:
  - backend_accept_notify fix
  - MODLS73: Custom response code support
  - MODLS71: Simpla authorization fix
  - Fixed restore global mod_lsapi after easyapache rebuilding


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-20
changelog:
  - /dev/urandom used to generate secret file
  - Default value for lsapi_backend_children changed to 120
  - Default socket path changed to /var/run/mod_lsapi
  - Creating default socket path on start
  - Coverity issues small fixes
  - Fixes for EA4
  - Add to file /etc/container/php.handler handlers for EA4


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-21
changelog:
  - 'Requires:' tag changed to liblsapi only
  - Added force update after lsphp rebuild
  - MODLS98: /var/run/mod_lsapi directory creation fix
  - MODLS102: TMPDIR var in default config
  - Removed dependency on CageFS
  - MODLS100: cagefs mount point removed
  - MODLS90: lsapi_backend_use_own_log option added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-22
changelog:
  - MODLS-94: Error in case of setup mod_lsapi on CL5 without any panel
  - MODLS-107: REDIRECT_STATUS message supressed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-24
changelog:
  - MODLS-104 lsapi_resend_if_crashed option added
  - MODLS-108: domain name added into lsphp socket name
  - MODLS-109 Fix POST >100K fails when body length is omitted
  - adaptive_mmap() in lscapi_send_request()
  - MODLS-105 lscapi_send_request() refactoring
  - MODLS-106: Fixup for rare backup connection fails


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-26
changelog:
  - MODLS-125: Do not allow to process .php.disabled extensions
  - MODLS-126: switch_mod_lsapi on 7.2 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-27
changelog:
  - MODLS-130: Full info in sulsphp error messages
  - MODLS-132: Fix wrong processing of lsapi.conf by switch_mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-29
changelog:
  - Fixes for switch utility for EA4
  - MODLS-128: switch_lsapi script fix
  - MODLS-153: Add more log info in case of entering jail error
  - MODLS-151: Dependencies from older alt-php packages removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-32
changelog:
  - Fix in script for CL 7.2 version
  - MODLS-155: default value of mutex mechamism changed to posixmem
  - MODLS-156: LSAPIPath option support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-33
changelog:
  - MODLS-169: Don't flood /tmp with send_request() buf artifacts
  - MODLS-170: Config option for alternate tmp directory
  - lscapi_reset_internal_error_state definition moved to lscapi.h


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-9
changelog:
  - MODLS-231: Fix HTTPOXY vulnerability
  - MODLS-232: Removing of mod_ruid2 configs added to EA3 rebuilding hook
  - MODLS-230: connection pool mode switched to on by default
  - poll mask changed in lscapi_is_socket_closed


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.0-10
changelog:
  - MODLS-227: Errors during execute cloudlinux_ea3_to_ea4 with --mod_lsapi 
  - MODLS-226: Lsapi script should have verifying of cagefs install


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-11
changelog:
  - MODLS-234: Fix switch_mod_lsapi for PLESK systems
  - AAP-104: Improve communication between mod_lsapi worker and starter


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-12
changelog:
  - MODLS-240: event mask for poll in waiting output from lsphp changed
  - AAP-110: unnecessary restart of Apache during EA3 build removed
  - MODLS-238: LVE_NO_MAXENTER flag added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-15
changelog:
  - MODLS-252: replacement of native php avoided
  - Filtering of HTTP_AUTHORIZATION and HTTP_PROXY_AUTHORIZATION removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-16
changelog:
  - connection pool mode switched to off by default
  - MODLS-256: fixing of broken lsapi.conf on EA4 added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-17
changelog:
  - MODLS-248: logrotate config for sulsphp_log added
  - MODLS-257: Scriptlet automation --setup and --uninstall added for EA4
  - MODLS-259: Possibility to set PHPRC via SetEnv added
  - MODLS-260: Fix switch_mod_lsapi for CL5


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-18
changelog:
  - MODLS-254: Fix lsphp path in /etc/container/php.handler added
  - MODLS-262: lsapi_per_user option added
  - AAP-106: Fix to standard behavour of PHPRC on EA4 php added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-19
changelog:
  - MODLS-272: Possibility to pass env vars to safe env added
  - MODLS-271: correct /usr/local/bin/lsphp symlink on PLESK
  - MODLS-266: Config option management fixed
  - MODLS-268: rewriting of lsapi config file on EA4 fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-21
changelog:
  - MODLS-261: Dependency from alt-php56 removed from EA4 mod_lsapi rpm
  - MODLS-249: Fix for full logging of backend messages
  - MODLS-276: switch_mod_lsapi bug fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-22
changelog:
  - MODLS-281: Fix crashing Apache on DA servers
  - MODLS-274: user.ini support added to mod_lsapi-1.0
  - MODLS-277: Make sulsphp work with 500+ users in group
  - MODLS-279: mod_lsapi gets disabled after some time post enabling (fcgid mod, cpanel)
  - MODLS-273: Maximum path length for PHPRC increased


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-24
changelog:
  - Fix work in backend_accept_notify Off mode with multiple logs from backend
  - MODLS-275: check-php command ported to 1.0 branch


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-2

changelog:
  - MODLS-269: Make lsphp working with PHP versions selected with MultiPHP on EA4 when SuPHP enabled
  - MODLS-308: LSAPI protocol logging added
  - MODLS-333: Drop criu system service and use something similar internally. CRIU as a system service is not recommended for use
  - MODLS-332: Add some way to trigger images cleanup
  - MODLS-331: Change criu images perms to 0600, as existing 0644 might not be secure enough
  - MODLS-330: Hide all debug and extra messages. Activate them only with specific parameter
  - MODLS-229: Make lsphp wait for dump to end, so it can detect when it's restored from images and cleanup its dead children
  - Added librt for CloudLinux 6


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-3

changelog:
  - MODLS-344: Plesk 17.0.17 version does not read /usr/local/psa/admin/conf/templates/custom/domain/domainVirtualHost.php.
  - MODLS-311: CL7 only. First start of lsphp after reboot takes a lot of time(about 7 seconds longer than suphp). Try to make so-lib cache before first usage of lsphp
  - MODLS-339: Make global flag for signaling of removing all images for CRIU(it can bee needed when php will be updated)
  - MODLS-345: Add creation of dump on lsphp stopping
  - MODLS-359: Check if /etc/container/php.handler updates properly
  - MODLS-364: mod_lsapi with criu don't create criu imgs in directory which is set by lsapi_criu_imgs_dir_path option


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-4
changelog:
  - MODLS-347: Remove LSCAPI_CRIU_SYNC_FD from the output of lsphp (phpinfo). Because it is service info
  - MODLS-367: Detect when CRIU is stopped and lsapi_criu is On and write message to apache log: Start CRIU. Service is stopped.
  - MODLS-193: Support custom php.ini added
  - MODLS-370: Add to CRIU, creation images for different virtual host under one user
  - MODLS-366: Improper option scopes fixed
  - MODLS-376: Fix PHP Selector on Plesk + mod_lsapi
  - MODLS-339: Added description of lsapi_reset_criu_on_apache_restart flag to lsapi.conf file
  - MODLS-378: sulsphp_log permissions changed to default Apache ones


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-5
changelog:
  - MODLS-388: destroy_lve symbol lookup bug fixed
  - MODLS-389: starter lock mechanism changed to fcntl
  - MODLS-384: Conflict with ea-apache24 added to mod_lsapi spec
  - MODLS-379: /usr/selector and ea-php locations for lsphp added into csf rules
  - MODLS-374: Cache of spawn_info_t structure sent on every lsphp starting for domain" into mod_lsapi-1.0.criu


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-9
changelog:
  - MODLS-394: starter mutex switched to PTHREAD mech to avoid deadlocks on MPM Event
  - MODLS-340: Corrected CRIU functions
  - MODLS-405: DocRoot special value is added to lsapi_phprc option


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-10
changelog:
  - MODLS-368: Add mod_lsapi handler to EA4 PHP handlers
  - MODLS-399: Fetch litespeed sources over https for beta
  - MODLS-408: Add PHP71 handler
  - MODLS-391: Buffer temporary file completely before passing it to backend PHP process


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-11
changelog:
  - MODLS-401: Add dynamic tuning of lsapi_backend_children parameter
  - MODLS-410: Priority of php_value from httpd.conf lowered to PERDIR


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-12
changelog:
  - MODLS-419: Make script for switching lsapi from old mechanism(--enable-global, --enable-domain) to new mechanism(lsapi via web-interface of cPanel)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-13
changelog:
  - MODLS-423: php_value htaccess flag value changed
  - MODLS-422: Add ability to disable lsapi while it is enabled globally EA3
  - MODLS-424: uninstall does not work properly


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-14
changelog:
  - MODLS-430: Add lsphp handlers to users Plesk panel correctly
  - MODLS-431: lsapi_output_buffering option added
  - MODLS-414: env var for lsphp log prefix added
  - MODLS-417: Backend log changed to own file on EA4
  - MODLS-368: Removed suphp detection
  - Changed method of suphp detection


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-15
changelog:
  - MODLS-436: Add force option to switch_mod_lsapi --setup
  - MODLS-429: switch_mod_lsapi --build-native-lsphp is not executed randomly after upcp on EA3
  - MODLS-433: New mechanism lsapi and web-interface of cPanel. Proposed by cPanel team


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-16
changelog:
  - MODLS-403: Check for Cloudlinux added to liblsapi
  - MODLS-434: Handler value was dropped after update
  - MODLS-435: Conflict with mpm_itk added to EA4 mod_lsapi
  - MODLS-433: New mechanism lsapi and web-interface of cPanel
  - Added /opt/cloudlinux as safe path
  - Fix httpd24 CL7 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-17
changelog:
  - MODLS-443: Hotfix: add setup-light command for cleaning all garbage in htaccess wich bring by previous versions
  - MODLS-442: Configure uninstall/update mod_lsapi with Plesk panel
  - MODLS-440: looking for user.ini in home dir
  - MODLS-400: DA script changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-20
changelog:
  - MODLS-445: CRIU messaging changed
  - MODLS-456: Added handlers for php 7.2 for cPanel EA4 and Plesk


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-21
changelog:
  - MODLS-452: Fix destroying of starter mutex on worker and event MPMs
  - MODLS-457: PWD var added into safe environment as cwd of backend process
  - MODLS-464: Max size of response header package fixed
  - MODLS-463: Add application/x-httpd-ea-php72___lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp and application/x-httpd-ea-php72-lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp
  - MODLS-460: Add ability to set lsapi_backend_children manually


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-22
changelog:
  - MODLS-466: lsapi_backend_semtimedwait option switched on by default
  - MODLS-466: lsapi-cache service improved
  - MODLS-466: lsapi-cache service for CL6 implemented
  - MODLS-468: criu messaging changed
  - MODLS-476: Add corresponding to criu messages into sulsphp_log
  - MODLS-475: Cleanup criu images on dump error
  - AAP-189: ea-apache24-mod_suphp-0.7.2-21 package installation flush php handlers to suphp
  - MODLS-470: Reset all criu images on update criu-lve and alt-phpXY


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-23
changelog:
  - MODLS-479: Make correct output of the totBytesRead and bodyLen values
  - MODLS-478: Prefix lsapi errors with timestamps
  - MODLS-472: unlimit core file size when BACKEND_COREDUMP on


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-24
changelog:
  - MODLS-483: Fix premature mutex destroying on MPM Event
  - MODLS-482: Refactor CRIU patch for PHP
  - MODLS-472: unlimit core file size on CL6


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-25
changelog:
  - MODLS-494: implement ~/mod_lsapi_reset_me flag for removing all CRUI images for all domains of user
  - dependency from alt-libxml2 removed from ea-apache24-mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author:
  Timur Averianov <taverianov@cloudlinux.com> Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 1.1-86

changelog:
  - MAXWS-785: Fix backend termination script hanging in the background when there were too many processes
  - CLOS-3499: Update package to be compatible with CloudLinux 10


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.1-87

changelog:
  - CLOS-3355: Set the docroot and domain information in the env before spawning lsphp
  - CLOS-3574: Use LSPHPRC instead of PHPRC if ea-php is version 8.4 and higher
  - CLOS-3646: Support RLIMITs


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-93
changelog:
  - CLOS-1655: Add CRIU support for CL9 and CL10
  - CLOS-4290: Minor fixes in request parsing and configuration scripts


changelog: - Initial MAx Cache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> 1.0.0-1


changelog: - Initial MaxCache implementation for CloudLinux
author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 1.0.0-1


author: Serhii Kokhan <skokhan@cloudlinux.com> - 1.1.0-1
changelog:
  - MAXWS-1043: Remove htcache-watchd dependency; use per-request stat() polling (RevalidateInterval=0)
  - MAXWS-1042: Rename MaxCacheHTCache* directives to MaxCacheHtaccess*; old names kept as deprecated aliases
  - MAXWS-1042: Rename htcache-status handler to maxcache-htaccess-status; old name kept as deprecated alias
  - MAXWS-1042: Rename config file maxcache_htcache.conf to maxcache_htaccess.conf with migration


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.8-1
changelog:
  - EA-12853: Update ea-apache24-mod_security2 from v2.9.7 to v2.9.8
  - Remove 2 patches that were added upstream.
  	- 0003-Import-some-memory-leak-fixes-for-Mod-Security-2.9.x.patch
  	- 0004-Allow-Lua-5.4.patch
  - Add new patch for re.c to allow it to build on Ubuntu
  - Add new patch for tests on Ubuntu 20


author: Dan Muey <daniel.muey@webpros.com> - 2.9.9-1
changelog:
  - EA-12885: Update ea-apache24-mod_security2 from v2.9.8 to v2.9.9
  - Possible DoS vulnerability: CVE-2025-47947


author: Dan Muey <daniel.muey@webpros.com> - 2.9.10-1
changelog:
  - ZC-12886: Update ea-apache24-mod_security2 from v2.9.9 to v2.9.10
  - DoS vulnerability: CVE-2025-48866


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.11-1
changelog:
  - EA-12994: Update ea-apache24-mod_security2 from v2.9.10 to v2.9.11
  - prevent segmentation fault if the XML node is empty: CVE-2025-52891


author: Dan Muey <daniel.muey@webpros.com> - 2.9.12-1
changelog:
  - EA-13061: Update ea-apache24-mod_security2 from v2.9.11 to v2.9.12
  - fix: Improper error handling CVE 2025-54571


author: Cory McIntire <cory.mcintire@webpros.com> - 1.68.1-2
changelog:
  - EA-13378: Add CVE documentation for nghttp2 1.68.1
  - CVE-2026-27135: Denial of service via assertion failure due to missing state validation (CVSS 7.5)


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
  - EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.8-1
changelog:
  - EA-12821: Update ea-libxml2 from v2.13.6 to v2.13.8
  - [CVE-2025-32415] schemas: Fix heap buffer overflow in xmlSchemaIDCFillNodeTables
  - [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)


author: Dan Muey <daniel.muey@webpros.com> - 1.29.1-1
changelog:
  - EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  - CVE-2025-53859: A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> alutsiuk <alutsiuk@cloudlinux.com> - 3:1.29.1-1.cloudlinux

changelog:
  - MAXWS-821: Fixed ea-nginx build after merge of nginx-1.29.1 version
  - MAXWS-793: Bump conflict version for max_webserver
  - MAXWS-756: Remove lsapi_check_script directive from cpanel-lsapi.conf
  - MAXWS-673: Implemented varmatch block based on precompiled action handlers


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.29.1-1.cloudlinux.1
changelog:
  - MAXWS-821: Evaluate varmatch block for access directives in the access phase
  - MAXWS-828: Added return and return_status_code directives support in varmatch block
  - MAXWS-849: Added remove_type directive support in nginx
  - MAXWS-851: Normalize varmatch regex with base= to match filenames
  - MAXWS-828: Fixed error_page usage in varmatch if defined in global context
  - MAXWS-861: Fixed regex normalization and matching under varmatch subdirs
  - MAXWS-889: Re-evaluate varmatch rules against the resolved index file URI


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.5-1
changelog:
  - EA-13333: Update ea-nginx from v1.29.4 to v1.29.5
  - Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.29.7-1
changelog:
  - EA-13381: Update ea-nginx from v1.29.6 to v1.29.7
  - Security: buffer overflow in COPY or MOVE request handling with "alias" directive (CVE-2026-27654).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module on 32-bit platforms might cause a worker process crash (CVE-2026-27784).
  - Security: processing of a specially crafted MP4 file by ngx_http_mp4_module might cause a worker process crash (CVE-2026-32647).
  - Security: segmentation fault in worker process with CRAM-MD5 or APOP authentication when retry enabled (CVE-2026-27651).
  - Security: PTR DNS record injection in auth_http requests and XCLIENT command (CVE-2026-28753).
  - Security: SSL handshake succeeds despite OCSP rejecting client certificate in stream module (CVE-2026-28755).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.0-1
changelog:
  - EA-13436: Update ea-nginx from v1.30.0 to v1.31.0
  - Security: heap buffer overflow in ngx_http_rewrite_module (CVE-2026-42945).


author: Cory McIntire <cory.mcintire@webpros.com> - 1.31.1-1
changelog:
  - EA-13448: Update ea-nginx from v1.31.0 to v1.31.1
  - Security: remote code execution via worker process memory pool handling (CVE-2026-9256).


author: EA4 Update Bot <cory.mcintire@webpros.com> - 1.31.3-1
changelog:
  - EA-13503: Update ea-nginx from v1.31.2 to v1.31.3
  - Security: heap buffer overflow when using map with regex, potentially allowing remote code execution or worker process denial of service via a crafted HTTP request (CVE-2026-42533).
  - Security: memory disclosure when using the ngx_http_slice_module (CVE-2026-60005).
  - Security: use-after-free when using the ngx_http_ssi_module (CVE-2026-56434).


author: CloudLinux <packages@cloudlinux.com> - 0.64-7
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.64-7
  - EA-13411: Build against ea-nginx version v1.30.0


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.65-1.cloudlinux.1
changelog:
  - EA-13468: Use %{version} for Source0/setup; drop stale module_version macro (fixes v0.64.tar.gz not found)


author: CloudLinux <packages@cloudlinux.com> - 0.39-9
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.39-9
  - EA-13411: Build against ea-nginx version v1.30.0


author: CloudLinux <packages@cloudlinux.com> - 0.9.6-5
changelog:
  * Thu Apr 16 2026 Cory McIntire <cory.mcintire@webpros.com> - 0.9.6-5
  - EA-13411: Build against ea-nginx version v1.30.0


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 1:7.3.33-15.cloudlinux.3
changelog:
  - EA4D-746: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.3.33-15.cloudlinux.6
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-14178: fix integer overflow in array_merge (ext/standard/array.c)
  - CVE-2025-1736: fix for PHP SOAP extension


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.3.33-15.cloudlinux.9
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1:7.3.33-15.cloudlinux.11
changelog:
  - ALTPHP-2422: Disable OPcache SCCP pass (bit 0x80) in default optimization_level
    to avoid runtime infinite loop caused by SCCP+DFA miscompilation
    (e.g. WordPress wp_replace_in_html_tags on CloudLinux 10 + cPanel)


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 1:7.3.33-15.cloudlinux.12
changelog:
  - CLOS-4167: Add per-domain site isolation support to LiteSpeed SAPI; updated DEB LiteSpeed SAPI source to 8.3


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.3.33-15.cloudlinux.14
changelog:
  - ELS-2599: Sync CVE patches from alt-php73
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - EA4D-789: Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18.cloudlinux.6
changelog:
  - EA4D-797: revert to use system libxml2 lib for all platforms
  - EA4D-808: fix Provides field in debian/control to use exact versions
  - EA4D-811: remove libphp7.so from _root_httpd_moddir to fix file conflicts


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 1:7.4.33-18.cloudlinux.10
changelog:
  - ELS-2599: Sync CVE patches from alt-php74
  - CVE-2026-14355, CVE-2026-6722, CVE-2026-6735, CVE-2026-7261,
    CVE-2026-7262, CVE-2026-7568


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7.4.33-13.cloudlinux.5
changelog:
  - EA4D-789: Security fixes
  - CVE-2024-11235: use-after-free for ??= due to incorrect live-range calculation


author: Eduard Abdullin <eabdullin@cloudlinux.con> - 8.0.0-2.cloudlinux.1
changelog:
  - Fix patch 0007 with cloudlinux-php-fpm patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 8.0.3-2.cloudlinux.1
changelog:
  - remove 0005-Ensure-that-php.d-is-not-scanned-when-PHPRC-is-set.patch for EA4D-265
  - Update litespeed log patch for litespeed-7.9


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
    Adjusted release to -6 due to OBS build issues of the gems


