Security - PHP RCEs reported

Yeah, I've just switched all my 14.4 FreeBSD servers over to quarterly pkg updates.

That seems to be the current focus of the FreeBSD team regarding security for the 14 branch.
 
On https://pkg-status.freebsd.org/builds?jailname=144amd64 I can see the quarterly build was started Wed, 21 Oct 2026 19:31:46 GMT
Could please someone explain what "Exp builds", "Package builds" and "Qat builds" means on this site?

If one is interested in the security of the pkgs, and not the latest updates of the pkgs, should one use quarterly or latest?
My impression: it depends 🤪 E.g.: I'm running a Navidrome server at home. It was on quarterly and did not receive important security fixes at all. Why? Probably because Navidrome has no feature and bugfix releases. Just run the most recent feature release to also getsecurity fixes. So I've switched that server to latest.

That seems to be the current focus of the FreeBSD team regarding security for the 14 branch.
For me it seems to be random, which builds are started first and therefore finish first. Could anybody clarify?
 
I am still not seeing the update for PHP85 on my 14.4 (quarterly) machine.
Ok, I upgraded the system to 14.4p12 and now the update came through. Is this related?

It seems that the Fastly CDN is very, very slow to mirror the changes.
Would any of the FreeBSD Mirrors) have the latest updates, and how could I point pkg to download them?
 
Nothing for 15.1-RELEASE quarterly...

I’m starting to get worried. Three days, and nothing. I no longer know what to say at work to explain the time taken.

Should I change the servers in production to "latest"?

What do you recommend doing?

P.D.:
I started a Poudriere build yesterday to try and generate the binaries... I’ll check in a few hours to see if the build has finished.
 
Nothing for 15.1-RELEASE quarterly...

I’m starting to get worried. Three days, and nothing. I no longer know what to say at work to explain the time taken.
Yeah, it's gone beyond embarrassing. I mean, FreeBSD was always lagging behind with security patches compared to most Linux distributions, but it's been days now.
Should I change the servers in production to "latest"?

What do you recommend doing?

P.D.:
I started a Poudriere build yesterday to try and generate the binaries... I’ll check in a few hours to see if the build has finished.
Most of the servers I manage that are on FreeBSD and run PHP are still down because they're far from critical. There's one where after a day I couldn't justify waiting any longer, I've gone the ports route: checked out ports from git on the quarterly branch and installed all PHP packages I have installed on that server from ports. It should be OK since I'm using both the quarterly branch from the ports repo and the quarterly package repo for binary packages, so as soon as the packages are available in the pkg repository I'll just reinstall the lot from there.
 
FreeBSD was always lagging behind with security patches compared to most Linux distributions
Linux doesn't take care of their distributions as a whole like FreeBSD does. Linux only takes care of their kernel. FreeBSD is a cohesive, complete system that all works together. When someone else screws things up, they don't rely on some outsiders to guarantee their work.
 
  • Like
Reactions: mer
It seems we're not out of the woods yet. Even if you updated PHP one way or another.

We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026.

 
And as it works for me as written in the docs: No, you don't have to run a pkg update prior to a pkg upgrade.
I would imagine that to be correct if one is staying on the same base (quarterly vs latest). If you have been pulling quarterly and switch to latest I think the pkg update -f is almost mandatory.
 
I would imagine that to be correct if one is staying on the same base (quarterly vs latest). If you have been pulling quarterly and switch to latest I think the pkg update -f is almost mandatory.
Of the three servers I manage, on one that is for testing, I made the change from quarterly to latest like this:


# mkdir -p /usr/local/etc/pkg/repos

# cat << 'EOF' > /usr/local/etc/pkg/repos/FreeBSD.conf
FreeBSD-ports: {
url: "pkg+https://pkg.freebsd.org/${ABI}/latest"
}
EOF

# pkg upgrade



# pkg info | grep 'php8[2-5]-[0-9].*'

Code:
mod_php85-8.5.12               PHP Scripting Language (8.5.X branch)
php85-8.5.12                   PHP Scripting Language (8.5.X branch)

After running the 'pkg upgrade' command, the new packages were immediately displayed; the 'pkg update' command was not required.
 
Of the three servers I manage, on one that is for testing, I made the change from quarterly to latest like this:


# mkdir -p /usr/local/etc/pkg/repos

# cat << 'EOF' > /usr/local/etc/pkg/repos/FreeBSD.conf
FreeBSD-ports: {
url: "pkg+https://pkg.freebsd.org/${ABI}/latest"
}
EOF

# pkg upgrade



# pkg info | grep 'php8[2-5]-[0-9].*'

Code:
mod_php85-8.5.12               PHP Scripting Language (8.5.X branch)
php85-8.5.12                   PHP Scripting Language (8.5.X branch)

After running the 'pkg upgrade' command, the new packages were immediately displayed; the 'pkg update' command was not required.
Cool. I wonder if pkg upgrade pulls in the "latest" catalogs based on the current config. As in when configured for quarterly, pkg upgrade pulls in that catalog, then if user switches to latest, the next pkg upgrade pulls in the "latest catalog for latest" before running upgrade.
 
Back
Top