PHP Security Update coming Oct 20

[Bayview]

It sounds like a very serious PHP issue is being addressed tomorrow, or maybe even earlier, according to an announcement here: https://www.php.net/archive/2026.php#2026-10-20-1
Any idea how quickly we can expect new lsphp versions on the repository?

 

[Cold-Egg]

Once the upstream is ready, we will do it as fast as we can.

 

[Nicolas Maillard]

The secure versions were released by PHP (8.2.35, 8.3.36, 8.4.27, 8.5.12).

 

[tokieee]

Good day. Php patch is now available.

 

[vojcik]

Any news at this matter?

 

[kdot]

This is extremely critical. Please provide us with a timeline.

 

[xirtam]

Once the upstream is ready, we will do it as fast as we can.

Any update? Everyone is out with their PHP but OLS still has the old lsphp

 

[lfattinger]

It's out now, thanks

 

[anchor76]

Hi,
We're using lsphp as well, so we're looking forward to the security update.
Thanks for your work on this, and hopefully the updated packages will be available soon!

 

[d.ohlin]

I could be mistaken here, but I think updates have been pushed....at least on my two OLS servers (one Ubuntu 24.04 and one 26.04) I'm now seeing PHP versions 8.3.36 and 8.4.27 after apt upgrade. One of them I did have to reinstall the LiteSpeed repository on in order for it to update successfully however.

 

[papa zulu]

Can you guys also port this fix to older versions of php, such as 7.4 and on older, Bionic servers?

 

[xirtam]

Can you guys also port this fix to older versions of php, such as 7.4 and on older, Bionic servers?

there is no fix for PHP older than 7.4

 

[papa zulu]

Yes, but there is a fix for php 7.4
It would be great if this fix can also be in the lsphp version 7.4 for Bionic servers

 

[xirtam]

Yes, but there is a fix for php 7.4
It would be great if this fix can also be in the lsphp version 7.4 for Bionic servers

Yes 7.4, not older. You can always recompile patched PHP yourself. 7.4 patched is in the PHP GitHub repo.

 

[idahodev]

Ondřej Surý backported 8.2.x fixes to 7.4 and 5.6, from what I've read, but that's probably a lot of work to integrate that into an official lsphp release.

 

[xvii]

Hey, just a little concerning there's been no updates. Any ETA?

 

[Bayview]

Thanks for getting the updates on the repo quickly.

 

[xvii]

There are some pushes to the docker hub tag an hour ago, they do have updated PHP! Thanks

 

[epionier]

as far as I see not all lsphp packages were updated. Are there some (ls)php packages that are not affected?

e.g. (old ones highlighted with bold)

lsphp83-mysql/trixie,now 8.3.36-1+trixie amd64 [installed,automatic]
lsphp83/trixie,now 8.3.36-1+trixie amd64 [installed,automatic]
lsphp85-apcu/trixie,now 5.1.27-1+trixie amd64 [installed]
lsphp85-common/trixie,now 8.5.12-2+trixie all [installed]
lsphp85-curl/trixie,now 8.5.12-1+trixie amd64 [installed]
lsphp85-igbinary/trixie,now 3.2.16-1+trixie amd64 [installed]
lsphp85-imagick/trixie,now 3.8.1-1+trixie amd64 [installed]
lsphp85-intl/trixie,now 8.5.12-1+trixie amd64 [installed]
lsphp85-memcached/trixie,now 3.4.0-1+trixie amd64 [installed]
lsphp85-msgpack/trixie,now 3.0.1-1+trixie amd64 [installed]
lsphp85-mysql/trixie,now 8.5.12-1+trixie amd64 [installed]
lsphp85-redis/trixie,now 6.3.0-1+trixie amd64 [installed]
lsphp85/trixie,now 8.5.12-1+trixie amd64 [installed]

 

[papa zulu]

Can anyone confirm that the fix was also included in the patches for lsphp74?
I can see that it was updated yesterday, but it doesn't say anywhere whether the fix for these 2 vulnerabilities was included?
https://rpms.litespeedtech.com/debian/pool/main/focal/