Critical PHP updates

fln said:
We have backported the new PHP patching sub-system to the RHEL 7 branch. A new build is pushed out to the rhel7 and debian10 legacy release channels. It comes with latest PHP versions and all security patches (not just the latest CVEs).
@Richpark yes, the one patch file is for both CVEs.
Click to expand...
You guys are the best! Thank you so much for your hard work and support! Really appreciate it!
 
hostpanel said:
How i really know if i'm patched or not?
I already execute the da update + da build php.

I can see the follow patch on most of versions of PHP



That's mean that i'm "safe/patched" or do i need to do another procedure?
Click to expand...
If this patch-file exists, the patch has been applied after a PHP re-build.
 
Aar said:
If this patch-file exists, the patch has been applied after a PHP re-build.
Click to expand...
Thank you for your response, but how about the other cve? cve-2026-109619 the patch is the same as 618?

Also I notice that 8.2/8.3/8.4 doesn't have the patch on the folder...is that normal?
 
I noticed that for PHP 5.6, 7.0, and 7.2, there are update packages available. Have they been patched?
 
The legacy rhel7 and debian10 release channels got a new build. It fixes the patching order on servers that use LiteSpeed web server. Before this fix patches would fail to apply when lsphp mode is used.
 
fln said:
The legacy rhel7 and debian10 release channels got a new build. It fixes the patching order on servers that use LiteSpeed web server. Before this fix patches would fail to apply when lsphp mode is used.
Click to expand...
So? You guys are awesome! Both PHP 5.6 and 7.2 have been fixed as well?

Meanwhile, lsphp and php7.2 have also fixed the issue.
 
dxoa said:
It's me. I recompiled it, but did the patch include PHP 5.6 and 7.2?
Click to expand...

First make sure you see patches for 5.6 and 7.2. using the command:

Bash: 
ls -la /usr/local/directadmin/custombuild/patches/php-*/*-cve-2026-10961?.patch

Expected output:

Bash: 
-rw-r--r-- 1 root root 19603 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-5.6/173-php-5.6-cve-2026-109618.patch
-rw-r--r-- 1 root root 28416 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-7.0/184-php-7.0-cve-2026-109618.patch
-rw-r--r-- 1 root root 28296 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-7.1/186-php-7.1-cve-2026-109618.patch
-rw-r--r-- 1 root root 38460 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-7.2/159-php-7.2-cve-2026-109618.patch
-rw-r--r-- 1 root root 38329 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-7.3/139-php-7.3-cve-2026-109618.patch
-rw-r--r-- 1 root root 40315 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch
-rw-r--r-- 1 root root 40650 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-8.0/138-php-8.0-cve-2026-109618.patch
-rw-r--r-- 1 root root 49737 Oct 21 20:34 /usr/local/directadmin/custombuild/patches/php-8.1/114-php-8.1-cve-2026-109618.patch

Then check

Code: 
da build versions | grep avail

whether or not updates for PHP are offered.

If you see patches and no updates are available, then you are most likely secured.
 
  • Like
Reactions: fln
jasne said:
what about CVE-2026-109619 ? not ready yet ?
Click to expand...

You might check:

Bash: 
[root@poralix ~]# head /usr/local/directadmin/custombuild/patches/php-8.1/114-php-8.1-cve-2026-109618.patch
From 1e06d14cdc77d28b88d2daa99bdfdd4dfaae831b Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <[email protected]>
Date: Sun, 18 Oct 2026 20:12:35 +0200
Subject: [PATCH] Avoid state corruption via bailout

Minimal mitigation for EOL version.

Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)

[root@poralix ~]#
 
[root@3 custombuild]# ls -la /usr/local/directadmin/custombuild/patches/php-*/*-cve-2026-10961?.patch
-rw-r--r-- 1 root root 19603 10月 22 09:07 /usr/local/directadmin/custombuild/patches/php-5.6/173-php-5.6-cve-2026-109618.patch
[root@3 custombuild]#

lsphp 看起来并没有修复7.2 8.0 8.3?
 
After the update, I saw it. So, will this fix all the bugs? Don't have to recompile PHP again?

-rw-r--r-- 1 root root 19603 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-5.6/173-php-5.6-cve-2026-109618.patch
-rw-r--r-- 1 root root 28416 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-7.0/184-php-7.0-cve-2026-109618.patch
-rw-r--r-- 1 root root 28296 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-7.1/186-php-7.1-cve-2026-109618.patch
-rw-r--r-- 1 root root 38460 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-7.2/159-php-7.2-cve-2026-109618.patch
-rw-r--r-- 1 root root 38329 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-7.3/139-php-7.3-cve-2026-109618.patch
-rw-r--r-- 1 root root 40315 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch
-rw-r--r-- 1 root root 40650 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-8.0/138-php-8.0-cve-2026-109618.patch
-rw-r--r-- 1 root root 49737 Oct 22 15:13 /usr/local/directadmin/custombuild/patches/php-8.1/114-php-8.1-cve-2026-109618.patch
 
alinajafi said:
how to can fix ? and I had some patch and headres customs how to save ?
Click to expand...

Nobody knows what customisation you have. So we can not guide you on a way to save the customisation. Regular servers will get updated with the command:

Code: 
da update
da build php

and if you used an official way to customize software/installation the suggested commands should not remove the customisation.
 
You must log in or register to reply here.
Back
Top