On Thu, 2026-10-22 at 10:13 +0200, Marius Schwarz wrote: > Am 22.10.26 um 01:38 schrieb Adam Williamson: > > "Standard Red Hat Enterprise Linux deployments use PHP-FPM rather than > > mod_php. PHP-FPM workers exit on early initialization failures before > > reaching the corrupted structures, so remote code execution is > > difficult in practice and typically requires non-default behavior such > > as parsing a second request body during script execution." > > > The developers of PHP see this differently. They wrote: > > *"Who is at risk:* all PHP installations serving web requests, including > PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." > > src: https://www.php.net/archive/2026.php#2026-10-21-5 > > I would think, they do know better how it works ;)
Those aren't contradictory. I (and RH) aren't saying that Fedora/RH are not "at risk". I'm saying the risk is not as world-ending as the publicity says, for typical use of PHP on Fedora. There are vulnerabilities in Fedora *all the time*, we ship security updates regularly. Not all of them become a huge news deal and cause people to send emergency push requests to mailing lists. (Heck, the eMudhra thing that's *also happening right now* is arguably worse than the PHP vuln, but isn't getting anywhere near as much traction). > You referred to this for f43: > > https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449 > > which is not the entire php build , it's an update package to the > missing update package of "php", to fix a version number. The -1 build contained the security fix. The -2 build bumped the release number (not sure why). This update is the security fix update, because -1 was not submitted as an update on its own, so -2 contains the security fix compared to what is currently in stable. > It has already +6 karma at this time: It did not at the time I wrote my mail. Once it hit +3, it was automatically submitted to stable. > a) it should not need karma, as it's an emergency patch for a critical > vulnerablility. so critical that security firms reaserching it shut down > their websites!!! (i.e. wordfence did) I disagree. As I said, there are security vulnerabilities all the time, not all of which get this level of publicity/panic even when they are serious. Pretty much every kernel and firefox update that has happened in the last few months has contained fixes for 'important' or higher security issues, for instance. Sometimes the fixes aren't right; sometimes they break things. We can't just push any update that fixes a security issue stable without testing. > I also had the opportunity to see the exploit at work. It's really > trivial and a wonder that it was under the hood for 22 years. There appears to be some debate over how trivial it is to exploit this. Wiz has not disclosed their actual exploit code, and there are suggestions[0] that the publicly-released attempts to reproduce it aren't really that impressive. > b) it does not matter at all, if one component i.e. php-fpm out of 4 > use-cases -> "cgi,cli,fpm,mod_php" is safe, the rest is not. The PHP post says "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." This implies that there is *not* a demonstrated RCE exploit for mod_php or php-cgi. I don't know if php-cli is "at risk" but that seems like a much different use case with much different security parameters anyway (it's *always* the case that you should not blindly run code you don't understand through an interpreter). > Can now one pls push this to stable? This was always going to happen. Fedora and RH are part of the responsible disclosure process and the relevant folks were aware of this issue and preparing for it. That's why the updates were created so quickly. Release engineering was also aware and ready to push fixes stable once they met the necessary requirements. The F44 updates (php and ca-certificates) are already stable, F43 updates are being pushed now. [0] https://eliastaylor.com/noexploit/ -- Adam Williamson (he/him/his) Fedora QA Fedora Chat: @adamwill:fedora.im | Mastodon: @[email protected] https://www.happyassassin.net -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
