Why a Security Scan Says cURL Is Outdated on Our Servers

Some security plugins and scanning tools check the version number of cURL (the library PHP uses to make web requests) and warn you that it looks old. On FimuroHost Cloud Hosting this warning is a false alarm: security fixes are applied even though the version number does not change.

Why the version number looks old

Our web servers run on Red Hat Enterprise Linux. Red Hat uses a process called backporting: instead of jumping to a brand-new release of a package, which could break websites, it takes the security fixes from newer versions and applies them to the stable version already installed.

The result is a package that shows an older version number but contains the current security patches. Scanners that only compare version numbers cannot see this, so they report a problem that is not really there.

What you should do

• Nothing is needed on your side. You can safely dismiss the warning.
• If a payment provider or auditor needs confirmation, open a ticket and we can explain the backporting approach to them.
• If a specific application genuinely fails because it needs a newer cURL feature, tell us the exact error message so we can investigate.

Red Hat publishes more detail on this practice in its documentation about backporting security fixes.

Need help?

If anything here does not work as described, our team is happy to take a look. Open a support ticket from your client area or message us on WhatsApp at 01818160926.