Security - PHP RCEs reported

[msplsh]

Thanks to Muhammad Moinur Rahman who is hilariously "bofh" and Bryan Drewery (bdrewery)

 

[rotor]

Yeah, I've just switched all my 14.4 FreeBSD servers over to quarterly pkg updates.

That seems to be the current focus of the FreeBSD team regarding security for the 14 branch.

 

[Franconian_Witchcraft]

On https://pkg-status.freebsd.org/builds?jailname=144amd64 I can see the quarterly build was started Wed, 21 Oct 2026 19:31:46 GMT

Could please someone explain what "Exp builds", "Package builds" and "Qat builds" means on this site?

If one is interested in the security of the pkgs, and not the latest updates of the pkgs, should one use quarterly or latest?

My impression: it depends E.g.: I'm running a Navidrome server at home. It was on quarterly and did not receive important security fixes at all. Why? Probably because Navidrome has no feature and bugfix releases. Just run the most recent feature release to also getsecurity fixes. So I've switched that server to latest.

That seems to be the current focus of the FreeBSD team regarding security for the 14 branch.

For me it seems to be random, which builds are started first and therefore finish first. Could anybody clarify?

 

[TS]

I am still not seeing the update for PHP85 on my 14.4 (quarterly) machine.
Ok, I upgraded the system to 14.4p12 and now the update came through. Is this related?

It seems that the Fastly CDN is very, very slow to mirror the changes.
Would any of the FreeBSD Mirrors) have the latest updates, and how could I point pkg to download them?

 

[angelvg]

Nothing for 15.1-RELEASE quarterly...

I’m starting to get worried. Three days, and nothing. I no longer know what to say at work to explain the time taken.

Should I change the servers in production to "latest"?

What do you recommend doing?

P.D.:
I started a Poudriere build yesterday to try and generate the binaries... I’ll check in a few hours to see if the build has finished.

 

[SirDice]

Could please someone explain what "Exp builds", "Package builds" and "Qat builds" means on this site?

Only look at the package builds, those are the ones that will end up in the various repositories. You don't need to worry about the others.

 

[covacat]

arm64 does not have it in latest either. just build it yourself

 

[SirDice]

It's possible they might be waiting for www/node22, www/node24 and www/node26 to be updated. No inside information, just a guess.

Node.js — Wednesday, October 21, 2026 Security Releases

Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

nodejs.org

CVE-2026-111497 is an RCE.

 

[Koen Martens]

Nothing for 15.1-RELEASE quarterly...

I’m starting to get worried. Three days, and nothing. I no longer know what to say at work to explain the time taken.

Yeah, it's gone beyond embarrassing. I mean, FreeBSD was always lagging behind with security patches compared to most Linux distributions, but it's been days now.

Should I change the servers in production to "latest"?

What do you recommend doing?

P.D.:
I started a Poudriere build yesterday to try and generate the binaries... I’ll check in a few hours to see if the build has finished.

Most of the servers I manage that are on FreeBSD and run PHP are still down because they're far from critical. There's one where after a day I couldn't justify waiting any longer, I've gone the ports route: checked out ports from git on the quarterly branch and installed all PHP packages I have installed on that server from ports. It should be OK since I'm using both the quarterly branch from the ports repo and the quarterly package repo for binary packages, so as soon as the packages are available in the pkg repository I'll just reinstall the lot from there.