The announcement was sent around 2 hours before the updated package made
it to the archive, however. As
https://buildd.debian.org/status/package.php?p=php8.2&suite=bookworm-security
shows, most of the package builds weren't complete until 15:50 UTC
(having started at 14:11) or later (unless you were on armhf in which
case you got it after about an hour). It then took a further 20 minutes
or so for it to appear in the archive.
This is presumably because LTS doesn't have embargoed buildds, so the
build can't start until the embargo period is up (unlike stable, where
the packages were available as soon as the DSA was released).
This isn't normally a problem, but for such high-profile updates
(especially of large packages that take hours to build), I wonder if
it's worth either delaying the DLA until packages are available, or
noting in the DLA that packages may not immediately be in the archive as
they are currently being built.
That said, thank you to Guilhem for producing all the updates so quickly
- I really appreciate it!
Best wishes,
Michael
On 22/10/2026 03:10, Matt Zagrabelny wrote:
Are you subscribed to:
[email protected] <mailto:debian-lts-
[email protected]>
The notice that you were looking for was sent out at Oct 21, 2026,
10:12 AM EDT.
-m
On Wed, Oct 21, 2026 at 3:49 PM Julien Savoie
<[email protected] <mailto:[email protected]>> wrote:
Yes, I saw the update about half an hour after I sent this email.
Thanks for updating the package.
------------------------------------------------------------------------
*From:* Xavier <[email protected] <mailto:[email protected]>>
*Sent:* October 21, 2026 3:17 PM
*To:* Julien Savoie <[email protected]
<mailto:[email protected]>>; [email protected]
<mailto:[email protected]> <[email protected]
<mailto:[email protected]>>
*Subject:* Re: php 8.2 vulnerabilities / update
Le 21/10/2026 à 17:37, Julien Savoie a écrit :
> The current php8.2 in oldstable is:
>
> $ php -version
> PHP 8.2.34 (cli) (built: Oct 4 2026 14:03:09) (NTS)
>
> This means it's vulnerable to CVE-2026-109618 CVE-2026-109619. Are
> there any plans to update this to 8.2.35?
>
Hi,
php8.2 8.2.35-1~deb12u1 has been released. Did you update your machine ?
--
Michael Howe
Unix Platform Services Team Leader
IT Services, University of Oxford
