Security - PHP RCEs reported

Are the packages actually available for FreeBSD 14.4/14.5 latest yet? They don't appear for me, even with an update -f. I might be getting confused on the previous discussion talking about ports instead of pkg.
 
SirDice said:
As far as I can tell, for 14 amd64 quarterly, yes. Latest, no
Click to expand...

mhm, I have tried both, quarterly and latest on 14.5_p2

Code: 
FreeBSD: {
  url: "pkg+https://pkg.FreeBSD.org/${ABI}/quarterly",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/share/keys/pkg",
  enabled: yes
}
FreeBSD-kmods: {
  url: "pkg+https://pkg.FreeBSD.org/${ABI}/kmods_quarterly_${VERSION_MINOR}",
  mirror_type: "srv",
  signature_type: "fingerprints",
  fingerprints: "/usr/share/keys/pkg",
  enabled: yes
}

Both of them do not show any new php packages for me
 
Well, I'm very confused. I patched a lot of my servers manually, but the one on 14.5-p2 still does not see any pkg's for PHP 8.3.36. On Freshports (https://www.freshports.org/lang/php83/), the versions for FreeBSD:14:latest and FreeBSD:14:quarterly still show 8.3.35.

#freebsd-version
Code: 
14.5-RELEASE-p3

#pkg -vv
Code: 
Repositories:
  FreeBSD: {
    url             : "pkg+https://pkg.FreeBSD.org/FreeBSD:14:amd64/quarterly",
    enabled         : yes,
    priority        : 0,
    mirror_type     : "SRV",
    signature_type  : "FINGERPRINTS",
    fingerprints    : "/usr/share/keys/pkg"
  }
  FreeBSD-kmods: {
    url             : "pkg+https://pkg.FreeBSD.org/FreeBSD:14:amd64/kmods_quarterly_5",
    enabled         : yes,
    priority        : 0,
    mirror_type     : "SRV",
    signature_type  : "FINGERPRINTS",
    fingerprints    : "/usr/share/keys/pkg"
  }
  FreeBSD-latest: {
    url             : "pkg+https://pkg.FreeBSD.org/FreeBSD:14:amd64/latest",
    enabled         : no,
    priority        : 0,
    mirror_type     : "SRV",
    signature_type  : "FINGERPRINTS",
    fingerprints    : "/usr/share/keys/pkg"
  }

After -f updating both latest and quarterly:

#pkg search -r FreeBSD-latest php83
Code: 
php83-8.3.35

Same for FreeBSD (quarterly).

I give it an hour, then I finally switch to ports. Or am I doing something terribly wrong?
 
On https://pkg-status.freebsd.org/builds?jailname=144amd64 I can see the quarterly build was started Wed, 21 Oct 2026 19:31:46 GMT (that's after the ports tree was updated) and took 10 hours, perhaps it's currently still syncing the mirrors. Checking the actual build logs I can see all the updated PHP packages are there.

Poudriere bulk results

pkg-status.freebsd.org pkg-status.freebsd.org
(You'll need IPv6 to access this link)

The last build on latest was Tue, 20 Oct 2026 01:04:10 GMT, that's definitely before the PHP update.
 
SirDice said:
On https://pkg-status.freebsd.org/builds?jailname=144amd64 I can see the quarterly build was started Wed, 21 Oct 2026 19:31:46 GMT (that's after the ports tree was updated) and took 10 hours, perhaps it's currently still syncing the mirrors. Checking the actual build logs I can see all the updated PHP packages are there.

The last build on latest was Tue, 20 Oct 2026 01:04:10 GMT, that's definitely before the PHP update.
Click to expand...
Thx. So we can see that things are built, but how can I check that something is on the primary pkg-server that is mirrored? Why does Freshports still show the previous version for FreeBSD:14? How long does mirroring normally take?
 
SirDice said:
On https://pkg-status.freebsd.org/builds?jailname=144amd64 I can see the quarterly build was started Wed, 21 Oct 2026 19:31:46 GMT (that's after the ports tree was updated) and took 10 hours, perhaps it's currently still syncing the mirrors.
Click to expand...
So this build ended at cca 5:30 UTC. Now we have cca 15:45 UTC, that means syncing to mirrors lasts already longer than the build itself.

Something must be seriously broken, hard to believe that it could be normal timing.
 
Looking directly at the packagesite.yaml via pkg.freebsd.org:

Code: 
# fetch https://pkg.freebsd.org/FreeBSD:14:amd64/latest/packagesite.pkg

# grep '"name":"php83"' packagesite.yaml
{"name":"php83","origin":"lang/php83","version":"8.3.35","comment":"PHP Scripting Language (8.3.X branch)","maintainer":"bofh@FreeBSD.org",{"FreeBSD_version":"1404000","build_timestamp":"2026-10-15T02:44:10+0000","built_by":"poudriere-git-3.4.8-3-gd92fb7c0","cpe":"cpe:2.3:a:php:php:8.3.35:::::freebsd14:x64","port_checkout_unclean":"no","port_git_hash":"51bd63023f348e7b68be8d39f27040b861c9f24c","ports_top_checkout_unclean":"no","ports_top_git_hash":"8e18e3939be9e4ea489d5504d12de91827b8498b"}}
 
It was fairly straight forward to query current installed packages and let Poudriere compile them and then switch repository and clean up the system. So, if one is familiar with Poudriere, it is also an alternative.
Code: 
$ pkg version | grep php | head -n 2
mod_php84-8.4.27_1                 =
php84-8.4.27_1
 
PHP 8.2 and 8.4 in 14.4 amd64 quarterly (that's the same as 14.5 but just to spell it out!)

Installed and back online.

Very pleased the new versions are here, and big sincere heartfelt thank you to everyone who made it happen, but the communication wasn't good. Was there somewhere I should have been looking? I appreciate when it's all hands on deck, communication isn't front of mind, but feel like there could have been something? Or like I said, was I just not looking in the right place?
 
You must log in or register to reply here.
Back
Top