cPanel, Plesk, and CloudLinux Imunify360 Virtual Patching Guide for Web Hosting Providers

Shared and multi-tenant web hosting providers face unique challenges when remediating engine-level vulnerabilities across thousands of customer accounts. A consolidated hosting guide from 24x7ServerManagement and Plesk Support outlines the exact steps for cPanel, Plesk, and CloudLinux environments.

What Imunify360 WAF Rules Block—and What They Only Log

CloudLinux shipped emergency Imunify360 WAF rules (including rule v8.84) to block the session.upload_progress vector used by public CVE-2026-109619 exploits. However, hosting engineers must note that the out-of-memory path (CVE-2026-109618) is only logged by the WAF, making runtime patching mandatory.

Step-by-Step Remediation Across Major Hosting Panels

• Plesk Control Panel: Patch both the customer-facing PHP handlers (plesk-php82 through plesk-php85) AND Plesk's own internal GUI PHP binary.
• cPanel EasyApache 4 & Alt-PHP: Run yum update ea-php* and yum update alt-php*, then restart Apache, LiteSpeed, and CageFS.
• SiteHost & Container Hosts: As SiteHost demonstrated, globally disabling session.upload_progress.enabled in base templates reduces immediate exposure during rollout.

Be aware that ImunifyAV/AV+ without an active WAF module receives zero virtual-patching protection—updating the PHP binary is non-negotiable.

Handling Cross-Site Upload Breakage From WAF Rule 8.84

If a customer site relies on legitimate cross-domain file upload forms that break under Rule 8.84, upgrade that account's PHP runtime to 8.3.36 or 8.4.27 first before whitelisting the specific domain.

Verifying CageFS Skeleton Updates

On CloudLinux servers using CageFS, run cagefsctl --force-update after package upgrades so isolated tenant containers see the patched binaries. Full primary documentation is available via 24x7ServerManagement Hosting Security Guide.