News & Updates

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 have been released with fixes for 2 critical vulnerabilities that can allow unauthenticated remote code execution. Every PHP install serving web requests is affected, including PHP-FPM as used by Centmin Mod. Upstream advises there are no complete mitigations and that updating is the only safe choice, so patch as soon as you can.

CVEs addressed:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) - RCE via out-of-memory corruption. Out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) - RCE via stale global state. Request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it.

Centmin Mod covers both supported and end-of-life PHP branches:

• Fixed upstream - PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Upgrade to the fixed release within your PHP branch. 141.00beta01 now defaults to PHP 8.3.36, so fresh installs pick up the fix, but existing installs still need upgrading.
• Centmin Mod backport patch - PHP 7.2.34, 7.3.33, 7.4.33, 8.0.30 and 8.1.34 get the fix from inc/php_patch.inc (bug id cve-2026-109618). The version number does not change, so PHP must be rebuilt for the patch to apply. This affects 132.00stable and 140.00beta01, whose default PHP is 7.4.33.
• No fix available - PHP older than 7.2 is end-of-life with no patch available; move to PHP 8.2 or newer.

An SSH login check now reports when the installed PHP is still vulnerable and whether it needs an upgrade or a rebuild. Silence it with DMOTD_PHPCVE_2026_109618='n' in /etc/centminmod/custom_config.inc.

To update, run cmupdate and then centmin.sh menu option 5 to upgrade or rebuild PHP-FPM. See the PHP critical security update announcement, the PHP Upgrade / Downgrade guide and Security Backports for EOL PHP Versions for details.

The Centmin Mod CSF Firewall fork has been updated to v16.31, a security-focused release carrying the security fixes from the cPanel CSF fork (16.20 and 16.30-1), adapted and tested for Centmin Mod. The vulnerabilities fixed could allow an attacker to gain root access to the server, and some can be triggered without local access.

Also new in v16.31:

• Verified updates - csf -u checks the downloaded package against the mirror's published SHA256 checksum before installing, with TLS certificate verification enforced on all mirror fetches
• Downgrade support - new csf -ud rolls back to the previous v15.02 release using the same verified download
• Boot recovery - if saved firewall rules cannot be restored at boot, CSF now reports the problem and rebuilds the full ruleset from your configuration during that same boot

A follow-up v16.32 release on August 8, 2026 fixes fresh AlmaLinux 10 / Rocky Linux 10 installs, where the nft_compat, xt_conntrack and xt_multiport modules moved out of the base kernel package. CSF now detects the missing modules at start and auto-installs the matching kernel-modules-extra package.

On 132.00stable, 140.00beta01 and 141.00beta01, running cmupdate since August 25, 2026 switches you to the Centmin Mod CSF mirror with daily update checks, which auto-upgrade CSF to v16.31+. Check your version with csf -v and update manually with csf -u if you are still on an older version. See the CSF Firewall v16.31 security update announcement for details.

Nginx 1.31.2 (mainline) and 1.30.3 (stable) have been released with fixes for 3 security vulnerabilities. All three Centmin Mod branches (132.00stable, 140.00beta01, 141.00beta01) have been updated to Nginx 1.31.2 as the new default for fresh installs.

CVEs addressed:

• CVE-2026-42055 - Heap buffer overflow in ngx_http_proxy_v2_module / ngx_http_grpc_module when proxying to an HTTP/2 or gRPC backend (requires ignore_invalid_headers off plus large large_client_header_buffers; default FastCGI setups are unaffected)
• CVE-2026-48142 - Heap buffer overread in ngx_http_charset_module during UTF-8 decoding (requires a configured charset_map, which is not part of default configs)
• CVE-2026-42530 - Use-after-free in ngx_http_v3_module HTTP/3 QUIC processing (mainline only; HTTP/3 is disabled by default in Centmin Mod, so most installs are not affected)

The mainline 1.31.2 release fixes all 3 CVEs. The stable 1.30.3 release fixes 2 of them (CVE-2026-42055 and CVE-2026-48142); the HTTP/3 use-after-free (CVE-2026-42530) does not apply to the 1.30.x stable branch.

To update, run cmupdate and then centmin.sh menu option 4 to recompile Nginx. Or instead of cmupdate, update your local code first via centmin.sh menu option 23 submenu option 2 and then centmin.sh menu option 4 to recompile Nginx. See the Nginx Upgrade / Downgrade guide for details.

Nginx 1.31.1 (mainline) and 1.30.2 (stable) have been released with a fix for 1 security vulnerability. All three Centmin Mod branches (132.00stable, 140.00beta01, 141.00beta01) have been updated to Nginx 1.31.1 as the new default.

CVE addressed:

• CVE-2026-9256 - Heap buffer overflow in ngx_http_rewrite_module worker process when using a configuration with overlapping captures (potential arbitrary code execution)

To update, run cmupdate and then centmin.sh menu option 4 to recompile Nginx. Or instead of cmupdate, update your local code first via centmin.sh menu option 23 submenu option 2 and then centmin.sh menu option 4 to recompile Nginx. See the Nginx Upgrade / Downgrade guide for details.

Nginx 1.31.0 (mainline) and 1.30.1 (stable) have been released with fixes for 6 security vulnerabilities. All three Centmin Mod branches (132.00stable, 140.00beta01, 141.00beta01) have been updated to Nginx 1.31.0 as the new default.

CVEs addressed:

• CVE-2026-42945 - Heap buffer overflow in ngx_http_rewrite_module (potential code execution)
• CVE-2026-42926 - HTTP/2 request injection via proxy_set_body
• CVE-2026-42946 - Heap buffer overread in SCGI/uWSGI modules
• CVE-2026-42934 - Heap buffer overread in UTF-8 charset decoding
• CVE-2026-40460 - QUIC address spoofing via connection migration
• CVE-2026-40701 - Use-after-free in DNS OCSP processing

To update, run cmupdate and then centmin.sh menu option 4 to recompile Nginx. Or instead of cmupdate, update your local code first via centmin.sh menu option 23 submenu option 2 and then centmin.sh menu option 4 to recompile Nginx. See the Nginx Upgrade / Downgrade guide and the forum announcement for more info.

After over a decade running on the same design, the Centmin Mod website has been rebuilt from the ground up. The old site served us well, but it was showing its age - hard to read on phones, no dark mode, and documentation scattered across forum threads instead of being front and center on the site itself.

The new site fixes all of that. Every page now works properly on mobile, tablet, and desktop. There's a dark mode that follows your system preference or can be toggled manually. And most importantly, the documentation has been massively expanded with dedicated pages covering every major Centmin Mod feature in detail.

Here's what's new:

• Over 50 documentation pages covering Nginx, PHP-FPM, MariaDB, SSL, firewalls, email, backups, and more
• A comprehensive Menu Option 21 Data Management guide for backups, migrations, and S3 transfers
• Improved installation instructions with step-by-step walkthroughs for AlmaLinux and Rocky Linux
• An AI-powered search (press Cmd+K or click the search bar) that actually understands what you're looking for
• An AI chatbot assistant that can answer technical questions about Centmin Mod configuration and troubleshooting
• This live news feed you're reading right now, which automatically pulls the latest announcements from the community forums

The community forums remain the best place for support, bug reports, and discussions. The site and forums work together - the site provides the documentation and guides, while the forums handle the conversations and troubleshooting that need back-and-forth discussion.

If you spot any issues with the new site or have suggestions, feel free to post in the feedback and suggestions forum.

Centmin Mod 131.00stable and 140.00beta01 have been released with full AlmaLinux and Rocky Linux support.

Centmin Mod 130.00beta01 has opened public beta testing for AlmaLinux 8 and Rocky Linux 8 support and the AlmaLinux 8 & Rocky Linux 8 Beta Testing forum is now viewable. You can see an example AlmaLinux 8 based install on DigitalOcean droplet KVM VPS.

Centmin Mod 124.00stable & 130.00beta01 have been released.

Latest Centmin Mod 123.09beta01's Nginx 1.15.3+ now supports TLS v1.3 with two cryptographic libraries that can be built with Centmin Mod Nginx. Instructions for Nginx compiled with either BoringSSL or OpenSSL 1.1.1.

• For Centmin Mod Nginx with BoringSSL based TLS 1.3, see Enabling BoringSSL TLS v1.3. For Nginx 1.15.3 + BoringSSL TLS 1.3 with 0-RTT Early Data resumption.
• For Centmin Mod Nginx with OpenSSL 1.1.1 based TLS 1.3, see OpenSSL 1.1.1 Released with TLS 1.3 Support.

Akamai is sponsoring OpenSSL TLS 1.3 development for release in OpenSSL 1.1.0 branch which is an OpenSSL branch optionally supported by Centmin Mod 123.09beta01's Nginx 1.11 setup where you can switch between default Nginx 1.11 + LibreSSL crypto library and Nginx 1.11 + OpenSSL 1.0.2/1.1 branches (with BoringSSL support in development as well).

Updated both Centmin Mod 1.2.3-eva2000.08 stable and 1.2.3-eva2000.09 beta01 branches for Nginx 1.11.6 defaults & compatibility fixes for OpenResty Nginx Modules. For existing users, use centmin.sh menu option 4 to update Nginx. Update your local code via centmin.sh menu option 23 submenu option 2 first.

Updated both Centmin Mod stable and beta branches for Nginx 1.11.1 defaults for security updates (CVE-2016-4450). Use centmin.sh menu option 4 to update Nginx.

Centmin Mod LEMP stack users have 3 security updates for ImageMagick, OpenSSL & LibreSSL.

Centmin Mod 1.2.3-eva2000.09 beta01 branch has many improvements and new features added. A change log can be viewed on the forum. To try a test install or update, follow instructions in the official thread.

Updated both Centmin Mod stable and beta branches for Nginx 1.9.12 incompatibility with LibreSSL. Switched back to Nginx compiled against OpenSSL 1.0.2f and higher.

Updated both Centmin Mod stable and beta branches for Nginx PageSpeed Module 1.9.32.13 beta release.

Updated both stable and beta branches for Nginx 1.9.10 security fixes CVE-2016-0742, CVE-2016-0746, and CVE-2016-0747. Use centmin.sh menu option 4 to update Nginx.

Updated both stable and beta branches for official PHP 7.0 GA release supported downloads. PHP version 7.0.0+ on centmin.sh menu option 5 now downloads from official php.net hosted source tarball files.

Updated both stable and beta branches for Nginx 1.9.5 default with new HTTP/2 protocol support which replaces SPDY/3.1. Full details at Nginx 1.9.5 released with HTTP/2 support officially.

Updated Nginx Configuration page with two new listings for Laravel 5.1 Nginx install and for Centmin Mod centmin.sh menu option 22 auto WordPress installation.

Centmin Mod 1.2.3-eva2000.09 beta testing has begun. Nginx HTTP/2 page and HTTP/1.1 vs HTTP/2 benchmarks have been added. The first major addition is support for Nginx's new HTTP/2 alpha patch which supports ALPN TLS extensions.

Centmin Mod 1.2.3-eva2000.08 stable release has been updated to support CentOS 6.7 release. To update, use the new centmin.sh menu option 23 explained on the upgrade page.

Centmin Mod 1.2.3-eva2000.08 stable release is finally here after 12+ months of development work! New centmin.sh menu options 22 and 23 added. Check out the full change log or jump straight into installation.