Security - PHP RCEs - when will packages be available?

last1 said:
where do you see things are moving ?
Click to expand...
FreeBSD 15.1, amd64, latest, has PHP 8.4 and 8.5 updates. That's progress from where we were earlier today. Does mean moving from quarterly to latest, but at least there's an update I can install.

That fixes most of the servers I look after, but got one 14.4/8.2 and one 14.4/8.4 waiting.
 
I'm not entirely sure what I'm reading here:


The 144amd64 quarterly line shows parallel-build in progress, running for 8 hours now, with 35 "things" remaining (ports?). Been 35 for a while, so guessing it is building something huge.

Last quarterly line shows 37h17m to build, but that was for 10K "things" versus this other build of 3.5K "things". So maybe it will take roughly 13 hours in all, maybe 5 hours left? But will depend on those "things" left I assume, what failures there might be, and then someone/something has to test & copy packages to distribution points?

All speculation.
 
richardtoohey2 said:
I'm not entirely sure what I'm reading here:

Click to expand...

Same, I follow pkgsrc and Mageia's binary build status pages from time to time. Checked FreeBSD's earlier today, and it's gotta be one of the worst I've seen. No idea what anything means on there. No way to check individual package status. Customers poking me to throw money at me. And my action threshold has not passed my laziness line to fiddle around with a ports work around. I know as soon as I do that, the binary will come out.

EDIT: Here is current builds for 14.5 I think, https://pkg-status.freebsd.org/beef...amd64-default&build=pccd47a9adb03_sda04cf02c9

Looks like php is done. Just waiting on everything else.
 
Build in one jail, move pkg to another. Seems to run fine even through modules are 8.3.35...
Code: 
# jexec  15 php -v | grep built
PHP 8.3.36 (cli) (built: Oct 21 2026 19:53:52) (NTS)
# jexec 14 php -v | grep built
PHP 8.3.35 (cli) (built: Oct 15 2026 02:52:14) (NTS)
# jexec 15 csh
# pkg create -o /tmp php83-8.3.36 mod_php83-8.3.36
Creating package for php83-8.3.36
Creating package for mod_php83-8.3.36
# ls -l /tmp/*php*
-rw-r--r--  1 root wheel 1780410 Oct 21 21:42 /tmp/mod_php83-8.3.36.pkg
-rw-r--r--  1 root wheel 5410667 Oct 21 21:42 /tmp/php83-8.3.36.pkg
# exit
# cp /data/frog.example.com/tmp/*php* /data/pear.example.come/tmp/
# jexec 14 csh
# cd /tmp && pkg install php83-8.3.36.pkg mod_php83-8.3.36.pkg
# apachectl restart
# php --version
 
richardtoohey2 said:
I moved off ports about a year ago onto quarterly binary packages, and it's been smooth sailing. Until now.
Click to expand...
I also switched to binary & quarterly on my server. But that PHP update I (reluctantly) installed by using the ports - the alternative was to switch to latest (what I don't want to do on a server). Just upgrading PHP packages by ports on a binary environment isn't a problem and took around 20 minutes for my (just 9) PHP packages (first I compiled lang/php85 itself by first executing make install-missing-packages).
 
Anxiously awaiting the 8.5.12 package for 14.5-RELEASE.

Can anyone give an ETA or any info on what's going on?

We've had our production server offline for 18 hours now. It's by far the longest it's ever been offline 😞.
 
You must log in or register to reply here.
Back
Top