Security - PHP RCEs reported

where do you see things are moving ? This is really bad, for such a great, critical and _secure_ OS , to have critical software missing 12h after the fix was published
 
Hi,

I have various servers FreeBSD 15.1 updated, but


# pkg upgrade

Not show updates for PHP, my systems have 8.5.11

Early in the morning I closed web ports (80, 443 TCP with PF)

Any news about the update release?

P.D.:
In my OpenBSD the PHP is ready released and installed.
 
Prime your pkg repo by going from quarterly to latest.
What version are you on:
pkg -vv | grep url

Are you on quarterly? Switch to Latest

Other random advise while you wait for binaries:
  • Compile you own! For Core services, you can compile from ports.
  • Wait! Less used services, you can disable and wait for the package.
  • Compile once make you own pkg! pkg create
 
yes
Rudy said:
Core services, you can compile from ports. Less used services, you can disable and wait for package. Or, if all your hardware is the 'same' you can create you own package:
pkg create


Prime your pkg repo by going from quarterly to latest.
What version are you on:
pkg -vv | grep url

Are you on quarterly? Switch to Latest
Click to expand...

yes, on latest 14.5..

Repositories:
FreeBSD: {
url : "pkg+https://pkg.freebsd.org/FreeBSD:14:amd64/latest",
enabled : yes,
priority : 0,
mirror_type : "SRV",
signature_type : "FINGERPRINTS",
fingerprints : "/usr/share/keys/pkg"
}
FreeBSD-kmods: {
url : "pkg+https://pkg.freebsd.org/FreeBSD:14:amd64/kmods_quarterly_4",
enabled : yes,
priority : 0,
mirror_type : "SRV",
signature_type : "FINGERPRINTS",
fingerprints : "/usr/share/keys/pkg"
}
 
last1 said:
where do you see things are moving ?
Click to expand...
FreeBSD 15.1, amd64, latest, has PHP 8.4 and 8.5 updates. That's progress from where we were earlier today. Does mean moving from quarterly to latest, but at least there's an update I can install.

That fixes most of the servers I look after, but got one 14.4/8.2 and one 14.4/8.4 waiting.
 
I'm not entirely sure what I'm reading here:


The 144amd64 quarterly line shows parallel-build in progress, running for 8 hours now, with 35 "things" remaining (ports?). Been 35 for a while, so guessing it is building something huge.

Last quarterly line shows 37h17m to build, but that was for 10K "things" versus this other build of 3.5K "things". So maybe it will take roughly 13 hours in all, maybe 5 hours left? But will depend on those "things" left I assume, what failures there might be, and then someone/something has to test & copy packages to distribution points?

All speculation.
 
richardtoohey2 said:
I'm not entirely sure what I'm reading here:

Click to expand...

Same, I follow pkgsrc and Mageia's binary build status pages from time to time. Checked FreeBSD's earlier today, and it's gotta be one of the worst I've seen. No idea what anything means on there. No way to check individual package status. Customers poking me to throw money at me. And my action threshold has not passed my laziness line to fiddle around with a ports work around. I know as soon as I do that, the binary will come out.

EDIT: Here is current builds for 14.5 I think, https://pkg-status.freebsd.org/beef...amd64-default&build=pccd47a9adb03_sda04cf02c9

Looks like php is done. Just waiting on everything else.
 
Build in one jail, move pkg to another. Seems to run fine even through modules are 8.3.35...
Code: 
# jexec  15 php -v | grep built
PHP 8.3.36 (cli) (built: Oct 21 2026 19:53:52) (NTS)
# jexec 14 php -v | grep built
PHP 8.3.35 (cli) (built: Oct 15 2026 02:52:14) (NTS)
# jexec 15 csh
# pkg create -o /tmp php83-8.3.36 mod_php83-8.3.36
Creating package for php83-8.3.36
Creating package for mod_php83-8.3.36
# ls -l /tmp/*php*
-rw-r--r--  1 root wheel 1780410 Oct 21 21:42 /tmp/mod_php83-8.3.36.pkg
-rw-r--r--  1 root wheel 5410667 Oct 21 21:42 /tmp/php83-8.3.36.pkg
# exit
# cp /data/frog.example.com/tmp/*php* /data/pear.example.come/tmp/
# jexec 14 csh
# cd /tmp && pkg install php83-8.3.36.pkg mod_php83-8.3.36.pkg
# apachectl restart
# php --version
 
richardtoohey2 said:
I moved off ports about a year ago onto quarterly binary packages, and it's been smooth sailing. Until now.
Click to expand...
I also switched to binary & quarterly on my server. But that PHP update I (reluctantly) installed by using the ports - the alternative was to switch to latest (what I don't want to do on a server). Just upgrading PHP packages by ports on a binary environment isn't a problem and took around 20 minutes for my (just 9) PHP packages (first I compiled lang/php85 itself by first executing make install-missing-packages).
 
Anxiously awaiting the 8.5.12 package for 14.5-RELEASE.

Can anyone give an ETA or any info on what's going on?

We've had our production server offline for 18 hours now. It's by far the longest it's ever been offline 😞.
 
1000014466.png
 
So yes, things are moving and fluid. In the local poudriere run things have indeed progressed to _1 already. How this will impact the official FreeBSD build (progress/tempo) remains to be seen.
 
siladi said:
Just as a curiosity , how long does it take to setup poudrier and do a php build ? Is it less than 18 hours perhaps ?

:-/
Click to expand...
Just PHP (and its dependencies of course) on just one build jail (so one specific OS version on one specific architecture) on a not-underpowered piece of hardware; easily.

But that's not real life, and certainly not for multiple versions on multiple architectures and having to release full and internally consistent pkg repositories.

I only build small sets of packages that I need for my production environments. I think the largest of those is about 80 root ports (expanding to about 500 packages).

You can easily do a daily run for 10 different environments on a big rig (32 CPU, 256 GB RAM in my case)

But FreeBSD full builds are of an epic scale. I hope they come up with a scenario for future 'surgical replacement packaging' for stuff that is as central and critical as PHP..
 
Rudy said:
Prime your pkg repo by going from quarterly to latest.
What version are you on:
pkg -vv | grep url

Are you on quarterly? Switch to Latest

Other random advise while you wait for binaries:
  • Compile you own! For Core services, you can compile from ports.
  • Wait! Less used services, you can disable and wait for the package.
  • Compile once make you own pkg! pkg create
Click to expand...
Switching to latest is the recommended way for a production server? :-/
Setting up ports with build tools on each webserver? 🙈
Set up a build server to build php packages? 🤮

Situation currently translates to: you cannot just run a FreeBSD production server with pkg only.
 
angelvg said:
Hi,

I have various servers FreeBSD 15.1 updated, but


# pkg upgrade

Not show updates for PHP, my systems have 8.5.11

Early in the morning I closed web ports (80, 443 TCP with PF)

Any news about the update release?

P.D.:
In my OpenBSD the PHP is ready released and installed.
Click to expand...
you need a "pkg update" first.

​

 
DutchDaemon said:
But FreeBSD full builds are of an epic scale.
Click to expand...
Just to give an example, the FreeBSD package build servers are big beefy machines (they're called beefyXX for a reason) and a typical full build of the entire package repository often takes more than 24 hours to complete. That said, it's for EVERYTHING. When you set up your own repository you don't need to build EVERYTHING, only what you need.

Franconian_Witchcraft said:
Switching to latest is the recommended way for a production server?
Click to expand...
2026Q4 is relatively new, so quarterly and latest haven't diverged much yet. On the servers I maintain I track main ('latest') but I do build my own package repositories, I'm not depending on the FreeBSD package repositories.


Franconian_Witchcraft said:
Setting up ports with build tools on each webserver? 🙈
Set up a build server to build php packages? 🤮
Click to expand...
If it's one or two servers you could go the ports route, if you have more servers to maintain I can highly recommend setting up your own local repositories. It takes a bit of effort to set up but it'll pay off in the long run.
 
You must log in or register to reply here.
Back
Top