If your Monarx dashboard shows more than one Protect Version for the same agent (for example, 5.2.4 and 5.2.69 side by side, as in the Extensions view under Agents), this article explains why that happens and how to fix it.
Monarx Protect is our PHP RASP (runtime application self-protection that powers ThreatShield) extension that loads directly into each PHP handler on your server. Because a single server can run PHP through several handlers at once — mod_php, php-fpm, cgi-fcgi, LiteSpeed's lsphp, and often multiple PHP versions side by side — Protect is loaded independently into each one. Seeing two versions listed means some of those handlers are running the new Protect build and others are still running the old one.
Cause
This almost always happens after updating your Monarx software. The package update itself completes successfully and drops the new .so files on disk, but any PHP handler that was already running keeps the previously loaded extension in memory until it's restarted. A webserver reload does not force this — the handler needs a full restart. If only some of your PHP handlers (or PHP versions) were cycled after the update, the dashboard will report the new version for those and the old version for the rest, which is exactly the "two versions" you're seeing.
Solution: Restart your PHP handlers
Restart every PHP handler / version running on the server so each one picks up the new extension.
cPanel / CloudLinux / AlmaLinux (WHM, EasyApache):
# Restart PHP-FPM for each EasyApache PHP version in use, e.g.:
systemctl restart ea-php82-php-fpm
# If you're using mod_php via Apache/EA4:
systemctl restart httpd
# If you're on LiteSpeed:
systemctl restart lsws
Repeat the ea-php<version>-php-fpm restart for every PHP version installed on the server (check WHM's MultiPHP Manager for the list) — each version has its own copy of Protect loaded.
💡 If you're also using CageFS on the server, please be sure to also remount all your cages using the following command as administrator:
cagefsctl --remount-all
What does this command achieves?
Unmounts current instances: Drops the active virtual filesystem mounts (both the shared base skeleton and per-user directories) for all CageFS-enabled users.
Re-reads mount configurations: Re-evaluates global mount files like
/etc/cagefs/cagefs.mp, custom config files in/etc/cagefs/conf.d/, and individual user virtual mount files.
Resets LVE Namespaces: Kills active processes locked inside existing user LVE (Lightweight Virtual Environment) namespaces and creates fresh namespaces with the correct limits reset.
Remounts everything: Re-attaches the
/usr/share/cagefs-skeletonbase image alongside users' personal directories (such as public_html, home, and custom paths) into their respective environments.
❗ This command is commonly chained after updates or forced rebuilds to ensure global system dependency changes propagate instantly to all caged users.
Debian / Ubuntu:
# Restart PHP-FPM for each PHP version in use, e.g.:
systemctl restart php8.2-fpm
# If you're using mod_php via Apache:
systemctl restart apache2
Verify it worked
Per-handler check:
php -m | grep monarxprotectconfirms the extension is loaded for that specific PHP binary/version — run it once per PHP version if you have several installed.Dashboard check: go to Agents in the Monarx WebApp, select the agent, and open the Extensions tab. All PHP versions/SAPIs should now report the same, current Protect version.