On Thu, 2026-10-22 at 01:20 +0200, Marius Schwarz wrote: > You heared about PHP2SHELL? > > Someone build the 8.4.27-1 packages outside of bodhi but FORGOT to push > them manually into stable!
That's not quite how this works? Everything is built "outside of Bodhi", because Bodhi isn't a buildsystem. The *updates* for all releases are already present in Bodhi: * https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449 (F43) * https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9eba4bbc3 (F44) * https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9354b8a1e (F45) * https://bodhi.fedoraproject.org/updates/FEDORA-2026-9312bb744f (F46) F44 and F46 are already stable. F43 needs at least one more karma before it can be pushed. F45 will not be pushed yet because F45 is frozen and we have an RC, and it has not been accepted as a blocker or FE bug. Note Red Hat's assessment that this bug is somewhat less severe in context: https://access.redhat.com/security/cve/cve-2026-109618 "Standard Red Hat Enterprise Linux deployments use PHP-FPM rather than mod_php. PHP-FPM workers exit on early initialization failures before reaching the corrupted structures, so remote code execution is difficult in practice and typically requires non-default behavior such as parsing a second request body during script execution." This applies to Fedora as well. Most packaged PHP software in Fedora is set up to use php-fpm, and we don't actually ship mod_php any more at all (not since 2020). It's still a significant bug and if you're actually running a PHP server you should apply the fix ASAP, but it's not world-ending, probably. It goes without saying nobody should be running a publicly accessible server on Fedora 45 (or Rawhide) in any case. -- Adam Williamson (he/him/his) Fedora QA Fedora Chat: @adamwill:fedora.im | Mastodon: @[email protected] https://www.happyassassin.net -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
