PHP Security Update coming Oct 20

[Bayview]

It sounds like a very serious PHP issue is being addressed tomorrow, or maybe even earlier, according to an announcement here: https://www.php.net/archive/2026.php#2026-10-20-1
Any idea how quickly we can expect new lsphp versions on the repository?

 

[Cold-Egg]

Once the upstream is ready, we will do it as fast as we can.

 

[xirtam]

Once the upstream is ready, we will do it as fast as we can.

Any update? Everyone is out with their PHP but OLS still has the old lsphp

 

[papa zulu]

Can you guys also port this fix to older versions of php, such as 7.4 and on older, Bionic servers?

 

[xirtam]

Can you guys also port this fix to older versions of php, such as 7.4 and on older, Bionic servers?

there is no fix for PHP older than 7.4

 

[papa zulu]

Yes, but there is a fix for php 7.4
It would be great if this fix can also be in the lsphp version 7.4 for Bionic servers

 

[xirtam]

Yes, but there is a fix for php 7.4
It would be great if this fix can also be in the lsphp version 7.4 for Bionic servers

Yes 7.4, not older. You can always recompile patched PHP yourself. 7.4 patched is in the PHP GitHub repo.

 

[Bayview]

Thanks for getting the updates on the repo quickly.

 

[epionier]

as far as I see not all lsphp packages were updated. Are there some (ls)php packages that are not affected?

e.g. (old ones highlighted with bold)

lsphp83-mysql/trixie,now 8.3.36-1+trixie amd64 [installed,automatic]
lsphp83/trixie,now 8.3.36-1+trixie amd64 [installed,automatic]
lsphp85-apcu/trixie,now 5.1.27-1+trixie amd64 [installed]
lsphp85-common/trixie,now 8.5.12-2+trixie all [installed]
lsphp85-curl/trixie,now 8.5.12-1+trixie amd64 [installed]
lsphp85-igbinary/trixie,now 3.2.16-1+trixie amd64 [installed]
lsphp85-imagick/trixie,now 3.8.1-1+trixie amd64 [installed]
lsphp85-intl/trixie,now 8.5.12-1+trixie amd64 [installed]
lsphp85-memcached/trixie,now 3.4.0-1+trixie amd64 [installed]
lsphp85-msgpack/trixie,now 3.0.1-1+trixie amd64 [installed]
lsphp85-mysql/trixie,now 8.5.12-1+trixie amd64 [installed]
lsphp85-redis/trixie,now 6.3.0-1+trixie amd64 [installed]
lsphp85/trixie,now 8.5.12-1+trixie amd64 [installed]

 

[papa zulu]

Can anyone confirm that the fix was also included in the patches for lsphp74?
I can see that it was updated yesterday, but it doesn't say anywhere whether the fix for these 2 vulnerabilities was included?
https://rpms.litespeedtech.com/debian/pool/main/focal/