cPanel & WHM version 136 is now available, and hosting admins should treat it as an operations upgrade, not just another automatic version bump. The headline changes touch firewall update delivery, SSL management, PHP visibility, log retention, MariaDB planning, and operating-system support.
If you manage customer sites, reseller servers, agency hosting, or a small fleet of cPanel boxes, this release is worth a maintenance checklist. It also lands in a month with multiple cPanel security releases, so version verification matters.
What changed in cPanel & WHM v136
- CSF delivery changes: ConfigServer Security & Firewall is now delivered through cPanel’s signed update pipeline, and existing CSF installs are migrated to that path.
- Short-lived certificate readiness: v136 adds native support for short-lived SSL certificates with ACME-based issuance and renewal across SSL types.
- Unified SSL/TLS interface: SSL/TLS, SSL/TLS Status, and SSL/TLS Wizard workflows are consolidated into a single certificate interface.
- Server-wide PHP error logging: admins can standardize PHP logging behavior across accounts.
- Log retention controls: new controls help manage web server log storage and retention.
- PHP version visibility: end-of-life and hardened PHP versions are easier to distinguish in the interface.
- MariaDB 11.8 support: MariaDB 11.8 appears as an option in WHM’s database upgrade flow.
- Ubuntu 22.04 final support: cPanel says v136 is the last version supporting Ubuntu 22.04 LTS, so those servers need an Ubuntu 24.04 migration plan before moving beyond v136.
Security-release context
The v136 change log includes several security-relevant entries from April and May 2026, including targeted security releases, an update to cpanel-unbound 1.25.1 covering multiple CVEs, and an update to cpanel-exim 4.99.2 covering multiple Exim CVEs. That does not mean every v136 server is exposed in the same way, but it does mean admins should verify patched builds instead of assuming the nightly update succeeded.
Before updating production servers
- Confirm the current tier and version in WHM or
/usr/local/cpanel/cpanel -V. - Check free disk space and inode availability before starting the update.
- Take provider-level backups or snapshots where your hosting stack allows it.
- Review remote MySQL/MariaDB profiles and database upgrade blockers.
- Document custom CSF, AutoSSL, Exim, Dovecot, Apache, Nginx, PHP-FPM, and EasyApache changes.
- Pick a maintenance window for customer-facing servers.
Update path
Use WHM’s normal update path first: WHM > cPanel > Upgrade to Latest Version. If you prefer the command line, cPanel documents the upcp script for updates:
/usr/local/cpanel/scripts/upcp --cronAvoid forcing updates on a production box unless you know the server’s release tier and have read the current upgrade blockers. A forced update can jump to a build you did not intend to run.
Post-upgrade checks
- Confirm the installed cPanel & WHM version and build.
- Open WHM Security Advisor and verify CSF status, especially on servers that had CSF installed before v136.
- Check AutoSSL and the unified SSL/TLS interface for several representative customer domains.
- Review PHP version labels and prioritize accounts still on end-of-life PHP.
- Check PHP error-log defaults and web server log retention so disk usage does not surprise you later.
- Verify Exim, Dovecot, cPanel, Apache, Nginx, DNS, MySQL/MariaDB, and cron health.
- Read the latest update log in
/var/cpanel/updatelogsif anything looks odd.
MariaDB 11.8 planning
MariaDB 11.8 support is useful, but database upgrades deserve their own maintenance window. cPanel’s database upgrade documentation warns admins to back up databases before changing database versions and notes that database downgrades are not supported through the interface. Run the upgrade checker where available, review application compatibility, and test representative WordPress, WooCommerce, Joomla, Drupal, WHMCS, and custom PHP apps before rolling the change across a fleet.
Ubuntu 22.04 planning
Do not ignore the Ubuntu note. cPanel’s announcement says v136 is the last version to support Ubuntu 22.04 LTS. If you run Ubuntu 22.04, build the migration plan to Ubuntu 24.04 LTS before the next cPanel generation blocks you. For busy hosting servers, that means backups, transfer testing, customer communication, DNS TTL planning, mail validation, and rollback expectations.
Fix I.T. Phill recommendation
For single servers, update during a planned window and verify the services customers actually feel: websites, mail, SSL, DNS, PHP, database-backed apps, backups, and control-panel login. For fleets, stage v136 on a lower-risk node first, confirm CSF and SSL behavior, then roll by customer impact instead of updating every box at once.
Related Fix I.T. Phill guides
- cPanel & WHM WP2 May 2026 Security Update: Five CVE Patch Guide
- CVE-2026-41940 cPanel & WHM Auth Bypass: Impact Statement
- Find Large Files and Inodes on cPanel/WHM Servers
- Certbot with Nginx: Let’s Encrypt Install and Renewal Guide
