CWP (Control Web Panel, formerly CentOS Web Panel) shipped six releases between October 26 and November 3, 2026, adding support for EL10 distributions such as AlmaLinux and Rocky Linux 10, PHP 8.4 and 8.5, prebuilt packages that install PHP in seconds, and a security review of almost the entire panel. The team behind the free hosting control panel summed it up in an email to users saying the project is “under very active development”, and its public changelog backs that up with numbers.
Key points on the latest CWP updates in 20 seconds
- CWP now installs on AlmaLinux, Rocky Linux and RHEL 10, alongside EL7, EL8 and EL9.
- It adds PHP 8.4 and 8.5 plus its own patches for unsupported legacy versions.
- The API on port 2304 now requires a key for every call.
- The changelog lists 14 releases in 2026, versus two in 2025.
CWP is one of the longest-running free control panels for Red Hat-family Linux servers, with an optional paid tier (CWPpro), and a common alternative to cPanel or Plesk on small and mid-sized servers. In tests this publication ran with CWP some time ago, the panel worked well and covered what was needed to run a hosting server, although its interface left room for improvement in usability. The latest releases target that area as well as security.
Six releases in nine days: a change of pace in the changelog
CWP’s public changelog shows a clear jump. It recorded two releases in 2024 and another two in 2025, in August and November. In 2026 it already lists 14, from version 0.9.8.1223 on March 17 to 1.30.1 on November 3. Along the way the project dropped the 0.9.8.x numbering it had carried for years and moved to 1.2 in July. The sharpest acceleration came at the end of October: versions 1.26, 1.27, 1.28, 1.29, 1.30 and 1.30.1 appeared in just nine days.
The level of detail has changed too. Notes for earlier releases were short lists along the lines of “security improvements” or “adjustments to PHP versions”, while the 1.26 to 1.30.1 notes describe each fix, the symptom it caused and what was changed. CWP has not explained what is behind the faster pace, so any theory about how its team now works would go beyond what it has published.
EL10, PHP 8.5 and legacy PHP with in-house patches
Version 1.29, released October 31, adds EL10 support (AlmaLinux, Rocky Linux, RHEL and derivatives) to the installer, panel and packages. The changelog lists the adjustments involved: the user panel login now understands the yescrypt password format EL10 uses, the CSF firewall installs the kernel modules EL10 does not ship by default, and Postfix switches to lmdb maps. Installation uses the same command as on EL7 through EL9. Even so, CWP’s own website still recommends EL9, with EL8 as an alternative, for new servers.
On PHP, version 1.26 rounds out PHP 8.4 and 8.5 across the three selectors (PHP Selector, PHP-FPM Selector and PHP Switcher). According to CWP’s email, the default is PHP 8.3.36, alongside 8.4.27 and 8.5.12, although those exact numbers do not appear in the changelog. Version 1.28 brings two practical changes: PHP now installs from ready-made CWP packages instead of being compiled on the server, cutting the job from minutes to seconds, and end-of-life versions that CWP builds with its own security backport are labeled “CWP security patch”.
That last point needs context. CWP says it backports fixes for known vulnerabilities to older versions, which helps legacy sites that cannot migrate right away. But it is not the same as an officially supported release: the PHP project stopped shipping security fixes for PHP 8.1 at the end of 2025, so maintenance of those branches now depends solely on CWP. The sensible approach is still to treat those patches as a bridge while the code is upgraded to PHP 8.2 or later.
Security is the biggest block of changes
Version 1.30.1, billed as a security and stability update to the long-term support (LTS) release, reworks input validation and output escaping across dozens of modules in the admin, reseller and user panels. API v1, which listens on port 2304, now requires a key for every call, restricts reseller keys to their own accounts and no longer logs passwords. User panel login links now carry a one-time code that expires, and panel updates are downloaded only over verified HTTPS.
One change is worth checking before upgrading: the mail server now limits its default trusted networks to the server itself. Applications on other machines in a private network that used to send mail without authenticating will need SMTP authentication. According to the changelog, this only affects servers still using the old default configuration. Version 1.30 also adds two update channels, LTS (the default) and Edge (newest features first), and rebuilds CWP Secure Kernel, CWP’s hardened kernel, with health checks, a safe mode and automatic rollback. The email adds that the kernel is now included with any active support service and installed by its team on request.
History explains the emphasis. CWP has had two critical vulnerabilities that the US agency CISA added to its catalog of known exploited flaws: CVE-2022-44877, a remote command execution bug in the login page fixed in 0.9.8.1147, and CVE-2025-48703, an unauthenticated command injection in the file manager, fixed in 0.9.8.1205 and added to the catalog in November 2025. The email states that all security issues reported to the team are fixed in the current LTS release, and recommends restricting port 2304 to the IPs that use the API, or closing it if the API is not used. To update, run sh /scripts/update_cwp or rely on the nightly automatic update.
What doesn’t add up, and what’s coming
The email and the website disagree on a few points. The email refers to LTS 1.30.2, but the latest changelog entry is 1.30.1, and the same page lists 1.30.4 as the current CWP7 version. The email puts the legacy PHP patches between 5.6 and 8.1, while the changelog extends them from 5.4.45 to 8.1.34. And the nginx 1.30.6 it mentions is the panel’s internal web server (cwpsrv), not the nginx that serves websites. Apache moves to 2.4.69 and Roundcube to 1.6.20.
Among the announced next steps are a modernized mail system with rspamd spam filtering and Spamhaus DQS, which the email says is already on the Edge channel although the changelog does not mention it, and a next-generation interface and API. These are plans without dates. CWP Billing, meanwhile, is a commercial billing and support product that manages CWP servers and is pitched as a WHMCS replacement, with import from WHMCS 7 and 8, nine languages and pricing of $7.49 a month or $75 a year per domain. The email mentions a 15-day free trial, although the product page only offers a demo.
For readers comparing options, this site has also followed other panels such as Plesk Obsidian and its AlmaLinux 10 support, as well as the arrival of PHP 8.5. A Spanish version of this article is available on AdministracionDeSistemas.com.
Frequently asked questions
Does CWP run on AlmaLinux 10 and Rocky Linux 10?
Yes, since version 1.29, released October 31, 2026, which adds EL10 support. CWP still recommends EL9 or EL8 for new servers.
Which PHP versions does CWP support?
Up to PHP 8.5, plus legacy versions from 5.4 to 8.1 built with CWP’s own security patches, which do not replace official support from the PHP project.
How do you update CWP?
Run sh /scripts/update_cwp or rely on the nightly automatic update. Since 1.30 you can choose between the LTS and Edge channels.
Should CWP’s port 2304 be closed?
CWP recommends restricting it to the IPs that use the API, or closing it if the API is not used. Since 1.30.1, every call to that API requires a key.
Sources:
- CWP changelog
- CWP Billing
- CWP, update email to users (November 2026)
- BleepingComputer: CVE-2025-48703
- Security Affairs: CVE-2022-44877