ea-ruby27 for cPanel (EasyApache 4) on CloudLinux OS 7 and 8: - ea-ruby27-ruby-2.7.8-6.cloudlinux.1
To update on CloudLinux OS 7, 8 and 9: yum update 'alt-ruby*' 'ea-ruby27*'
To update on Ubuntu: apt-get update apt-get install --only-upgrade 'alt-ruby*'
Restart the Ruby applications afterwards, so they load the updated interpreter.
To check that a package is patched, compare its version with the list above. For example: rpm -q alt-ruby27 ea-ruby27-ruby (CloudLinux OS 7, 8, 9) dpkg-query -W 'alt-ruby*' (Ubuntu)
On 23 October 2026 the Ruby project published Ruby 4.0.9, 3.4.12 and 3.3.13. They fix four vulnerabilities in the Ruby regular expression engine (Onigmo): CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264. A specially crafted pattern can corrupt memory while the regular expression is compiled, and this can lead to remote code execution. An application is affected only if it builds regular expressions from input an attacker controls, for example with Regexp.new, Regexp.union or by interpolating input into a pattern. Applications that use only regular expressions written by their developers are not affected. Regexp.timeout does not protect against these issues.
We are aware and are building updated alt-ruby packages for CloudLinux OS, including the end-of-life Ruby versions we ship (alt-ruby 2.6 to 3.5), and ea-ruby27 for cPanel. They are not released yet. We will post an update here as soon as fixed packages are available in the repositories, with steps to install them.
Until then, avoid compiling regular expressions from untrusted input in your applications.