On 2026/10/21 19:36, Lars Bonnesen wrote: > Hi Stuart, > > I noticed the recent PHP2Shell security advisories affecting PHP, and I'm > trying to establish > the status of the OpenBSD packages. > > I'm running OpenBSD 8.0 with the official PHP 8.4.26 package. I have updated > all packages, but > no newer PHP 8.4 package is currently being offered. The package mirrors > already contain PHP > 8.5.11, but I understand that switching PHP branches is not an appropriate > substitute for a > security fix. > > Could you clarify whether the OpenBSD PHP packages are affected by these > vulnerabilities, and > whether a patched 8.4 package is being prepared? > > I couldn't find a relevant discussion on [email protected], so I thought I'd > ask you directly. > > Thanks for your work on the ports. > > Best regards > >
As usual for PHP updates, ports are updated, I have pushed through -stable package builds as well and they were done a few hours ago, so now it just depends how long it takes to feed out to mirrors. See commits in https://cvsweb.openbsd.org/ports/lang/php/8.4 etc -current packages will be a little later as it has to be done as part of a bulk build, but you can build yourself from cvs ports tree. Those parts are business as usual for any PHP update unless I'm otherwise indisposed. Due to the nature of the issue I also reinstalled a 7.9-stable build environment ahead of time and built amd64 packages for this too (that will not normally happen but it seemed prudent). Unlike chainguard who had code in advance and released binaries >6h ahead of the scheduled coordinated release, or various Linux distros who had code in advance and did stick to things, I couldn't start on the process until upstream released their files at around 14:36 UT. (Yes I was watching for them.) https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/#leak-and-disrupted-disclosure 8.5.11 won't help you. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12.
