Critical PHP updates

fln said:
A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.
Click to expand...
You really are a G.O.A.T. serious legend from DA, you were one of the first with everything patched and backported up to 7.4 today.
 
fln said:
A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.
Click to expand...
I have 74 servers with DA, most of them are AlmaLinux 8/9 and they got updated... Please provide 5.6 fix for CentOS 7 DA v1.668 if possible. I have about 12 servers still running legacy DA. Thank you!
 
hlt said:
I have 74 servers with DA, most of them are AlmaLinux 8/9 and they got updated... Please provide 5.6 fix for CentOS 7 DA v1.668 if possible. I have about 12 servers still running legacy DA. Thank you!
Click to expand...
CentOS 7 is old men, really inplace upgrade asap to alma 8/9.
 
exlhost said:
CentOS 7 is old men, really inplace upgrade asap to alma 8/9.
Click to expand...
I will do ASAP, but every server is ~400 GB MySQL database and if 5.6.40 got fixed on AlmaLinux, maybe same can be applied to CentOS at least till all gets updated. Hope this happens :)
 
fln said:
A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.
Click to expand...

I managed to install this patch for the 5.6 version, but am still getting errors on trying to update 8.1.
All other updates and patches were succesfull including more recent versions of PHP, like 8.3 and 8.4

Code: 
download_cached: using cached '/usr/local/directadmin/custombuild/cache/php-8.1.25.tar.gz' file
Patching PHP 8.1 ...
patching file ext/xml/compat.c
Hunk #1 FAILED at 376.
1 out of 1 hunk FAILED -- saving rejects to file ext/xml/compat.c.rej
patching file ext/xml/tests/gh14834.phpt
patch_dir_apply: failed to apply '/usr/local/directadmin/custombuild/patches/php-8.1/001-libxml2-with-pear-compat.patch' patch
install_php: failed to compile '/usr/local/directadmin/custombuild/cache/php-8.1.25.tar.gz' inside '/usr/local/directadmin/custombuild/tmp/tmp.VmFvkaAWkN.php-8.1.25.tar.gz'
 
hlt said:
I will do ASAP, but every server is ~400 GB MySQL database and if 5.6.40 got fixed on AlmaLinux, maybe same can be applied to CentOS at least till all gets updated. Hope this happens :)
Click to expand...
I was thinking like you too but eventually a day will come and we will have to move forward.

Today I saw that with the help of AI, I could easily upgrade a 10 years old script to PHP8.4 from PHP7.2 that I was delaying for years.
Within a week or so I'm planning to upgrade them all and drop 7.x completely (I have 7.2 and 7.4 both unfortunately).
 
hlt said:
I will do ASAP, but every server is ~400 GB MySQL database and if 5.6.40 got fixed on AlmaLinux, maybe same can be applied to CentOS at least till all gets updated. Hope this happens :)
Click to expand...
I've never really liked CentOS. Alma isn't bad, but Debian/Ubuntu is my go to OS.
 
fln said:
A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.
Click to expand...
Just to clarify - the 8.0.30* version included in the new update is patched as well?
 
Has anyone seen any patches actually available for CloudLinux 8 ? Their status site implies some PHP versions have been patched but nothing showing up here.
 
I still consider this a temporary fix. Or can we conclude this is a permanent solution? I'm still pushing developers to upgrade their websites to 8.3 or higher, which is still good. But i would like to give them more time.
 
I was checking the patches against php.net. There are 2 flaws, numbers are
CVE-2026-109618 and CVE-2026-109619,
Then I looked what I received on my D.A. system
# ls -l /usr/local/directadmin/custombuild/patches/php*/*-10961?.patch
-rw-r--r-- 1 root root 40315 Oct 21 18:29 /usr/local/directadmin/custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch
-rw-r--r-- 1 root root 40650 Oct 21 18:29 /usr/local/directadmin/custombuild/patches/php-8.0/138-php-8.0-cve-2026-109618.patch
-rw-r--r-- 1 root root 49737 Oct 21 18:29 /usr/local/directadmin/custombuild/patches/php-8.1/114-php-8.1-cve-2026-109618.patch

I am running those PHP versions of course.
But I am missing 109619

So, are we now patched and safe, or do we need to wait for the second flaw to get patched?

Note: I assume or understand the other PHP versions (8.2 - 8.5) are all okay, once we have done the "da build php".
 
fln said:
A new build is released. It includes patches for older PHP versions (7.3, 7.2, 7.1, 7.0, 5.6) and also a small fix for the PHP 8.1 compilation.
Click to expand...
Thanks! We have some servers running centos7. Can we expect patches or how can we apply the patches ourselves if you don't offer them?
 
  • Like
Reactions: hlt
You must log in or register to reply here.
Back
Top