git: 1a235373d266 - main - lang/php84: Disable session upload progress in shipped php.ini templates
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 23 Oct 2026 21:17:52 UTC
The branch main has been updated by bofh:
URL: https://cgit.FreeBSD.org/ports/commit/?id=1a235373d2661c911465f1ad1f50b5f0e2a1ba42
commit 1a235373d2661c911465f1ad1f50b5f0e2a1ba42
Author: Muhammad Moinur Rahman <bofh@FreeBSD.org>
AuthorDate: 2026-10-23 20:38:34 +0000
Commit: Muhammad Moinur Rahman <bofh@FreeBSD.org>
CommitDate: 2026-10-23 21:17:24 +0000
lang/php84: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
---
lang/php84/Makefile | 2 +-
lang/php84/files/patch-build_Makefile.global | 4 +-
lang/php84/files/patch-configure.ac | 4 +-
lang/php84/files/patch-php.ini-development | 13 +++++
lang/php84/files/patch-php.ini-production | 13 +++++
.../files/patch-sapi_apache2handler_config.m4 | 4 +-
lang/php84/pkg-message | 61 ++++++++++++++++++++++
7 files changed, 94 insertions(+), 7 deletions(-)
diff --git a/lang/php84/Makefile b/lang/php84/Makefile
index 82b7c3daba90..833bb8f5845a 100644
--- a/lang/php84/Makefile
+++ b/lang/php84/Makefile
@@ -1,6 +1,6 @@
PORTNAME= php84
DISTVERSION= 8.4.27
-PORTREVISION= 1
+PORTREVISION= 2
CATEGORIES?= lang devel www
MASTER_SITES= PHP/distributions
DISTNAME= php-${DISTVERSION}
diff --git a/lang/php84/files/patch-build_Makefile.global b/lang/php84/files/patch-build_Makefile.global
index 52531a83dabe..af0180489af8 100644
--- a/lang/php84/files/patch-build_Makefile.global
+++ b/lang/php84/files/patch-build_Makefile.global
@@ -1,6 +1,6 @@
---- build/Makefile.global.orig 2024-07-02 13:43:13 UTC
+--- build/Makefile.global.orig 2026-10-19 14:38:59 UTC
+++ build/Makefile.global
-@@ -91,14 +91,14 @@ test: all
+@@ -95,14 +95,14 @@ test: all
@if test ! -z "$(PHP_EXECUTABLE)" && test -x "$(PHP_EXECUTABLE)"; then \
INI_FILE=`$(PHP_EXECUTABLE) -d 'display_errors=stderr' -r 'echo php_ini_loaded_file();' 2> /dev/null`; \
if test "$$INI_FILE"; then \
diff --git a/lang/php84/files/patch-configure.ac b/lang/php84/files/patch-configure.ac
index e9c038fd5b15..0a032c8f82ad 100644
--- a/lang/php84/files/patch-configure.ac
+++ b/lang/php84/files/patch-configure.ac
@@ -1,4 +1,4 @@
---- configure.ac.orig 2024-09-10 16:10:06 UTC
+--- configure.ac.orig 2026-10-19 14:38:59 UTC
+++ configure.ac
@@ -55,6 +55,7 @@ AH_BOTTOM([
@@ -16,7 +16,7 @@
PHP_HELP_SEPARATOR([SAPI modules:])
PHP_SHLIB_SUFFIX_NAMES
PHP_BUILD_PROGRAM
-@@ -1368,7 +1368,7 @@ EXPANDED_PHP_CONFIG_FILE_SCAN_DIR=$(eval echo "$PHP_CO
+@@ -1357,7 +1357,7 @@ EXPANDED_PHP_CONFIG_FILE_SCAN_DIR=$(eval echo "$PHP_CO
EXPANDED_DATADIR=$datadir
EXPANDED_PHP_CONFIG_FILE_PATH=$(eval echo "$PHP_CONFIG_FILE_PATH")
EXPANDED_PHP_CONFIG_FILE_SCAN_DIR=$(eval echo "$PHP_CONFIG_FILE_SCAN_DIR")
diff --git a/lang/php84/files/patch-php.ini-development b/lang/php84/files/patch-php.ini-development
new file mode 100644
index 000000000000..d8a18aef9f61
--- /dev/null
+++ b/lang/php84/files/patch-php.ini-development
@@ -0,0 +1,13 @@
+--- php.ini-development.orig 2026-10-23 20:36:48 UTC
++++ php.ini-development
+@@ -1438,7 +1438,9 @@ session.trans_sid_tags = "a=href,area=href,frame=src,f
+ ; Development Value: On
+ ; Production Value: On
+ ; https://php.net/session.upload-progress.enabled
+-;session.upload_progress.enabled = On
++; Temporary mitigation for CVE-2026-115560 / CVE-2026-109619.
++; Remove once the fixed PHP release is in the tree.
++session.upload_progress.enabled = Off
+
+ ; Cleanup the progress information as soon as all POST data has been read
+ ; (i.e. upload completed).
diff --git a/lang/php84/files/patch-php.ini-production b/lang/php84/files/patch-php.ini-production
new file mode 100644
index 000000000000..7039fc1f51d8
--- /dev/null
+++ b/lang/php84/files/patch-php.ini-production
@@ -0,0 +1,13 @@
+--- php.ini-production.orig 2026-10-23 20:36:54 UTC
++++ php.ini-production
+@@ -1440,7 +1440,9 @@ session.trans_sid_tags = "a=href,area=href,frame=src,f
+ ; Development Value: On
+ ; Production Value: On
+ ; https://php.net/session.upload-progress.enabled
+-;session.upload_progress.enabled = On
++; Temporary mitigation for CVE-2026-115560 / CVE-2026-109619.
++; Remove once the fixed PHP release is in the tree.
++session.upload_progress.enabled = Off
+
+ ; Cleanup the progress information as soon as all POST data has been read
+ ; (i.e. upload completed).
diff --git a/lang/php84/files/patch-sapi_apache2handler_config.m4 b/lang/php84/files/patch-sapi_apache2handler_config.m4
index cb9874a7a4b0..8308cc7f7e42 100644
--- a/lang/php84/files/patch-sapi_apache2handler_config.m4
+++ b/lang/php84/files/patch-sapi_apache2handler_config.m4
@@ -1,6 +1,6 @@
---- sapi/apache2handler/config.m4.orig 2024-08-27 14:33:48 UTC
+--- sapi/apache2handler/config.m4.orig 2026-10-19 14:38:59 UTC
+++ sapi/apache2handler/config.m4
-@@ -61,7 +61,7 @@ if test "$PHP_APXS2" != "no"; then
+@@ -69,7 +69,7 @@ if test "$PHP_APXS2" != "no"; then
[AC_MSG_ERROR([Please note that Apache version >= 2.4 is required])])
APXS_LIBEXECDIR='$(INSTALL_ROOT)'$($APXS -q LIBEXECDIR)
diff --git a/lang/php84/pkg-message b/lang/php84/pkg-message
new file mode 100644
index 000000000000..e1f04695549f
--- /dev/null
+++ b/lang/php84/pkg-message
@@ -0,0 +1,61 @@
+[
+{ type: install
+ message: <<EOM
+SECURITY: session upload progress (CVE-2026-115560, informational)
+
+php.ini-production and php.ini-development now ship with
+session.upload_progress.enabled = 0 as a temporary mitigation until the
+next regular PHP bugfix release. It only takes effect if you copy one of
+these templates to /usr/local/etc/php.ini. Without a php.ini, the
+compiled-in default (enabled) applies.
+
+Applications that read $_SESSION["upload_progress_*"] (upload progress
+bars) will stop receiving progress data while this is off.
+EOM
+}
+{ type: upgrade
+ message: <<EOM
+SECURITY: session upload progress (CVE-2026-115560, informational)
+
+Until the next regular PHP bugfix release, session.upload_progress.enabled
+should be 0. The shipped php.ini-production and php.ini-development now
+set it, but existing php.ini files are never modified on upgrade, and
+with no php.ini the compiled-in default (enabled) applies. If you
+already applied this setting for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp),
+keep it; nothing further is needed.
+
+The issue needs an unusual combination: session.serialize_handler set
+to php_binary or php_serialize in configuration, switched to php at
+runtime with ini_set() before session_start(), with upload progress
+still enabled. Applications that never change the handler at runtime
+can keep the feature enabled.
+
+Check the effective value per SAPI (CLI and FPM/mod_php may load
+different ini files):
+
+ php -r 'var_dump(ini_get("session.upload_progress.enabled"));'
+
+For FPM/mod_php, use phpinfo() from a web request. Ini files are read
+from /usr/local/etc/php.ini and /usr/local/etc/php/*.ini.
+
+Check both halves of the precondition:
+
+ php -r 'var_dump(ini_get("session.serialize_handler"));'
+ grep -rn serialize_handler /usr/local/www /usr/local/etc/php* \
+ /usr/local/etc/apache2*
+
+A match on one half alone is not vulnerable; the combination is. To
+make runtime switching impossible in FPM, set in the pool config:
+
+ php_admin_value[session.serialize_handler] = php
+
+This breaks applications that legitimately need php_serialize at runtime.
+
+After changing any setting, restart the PHP service, e.g.:
+
+ service php_fpm restart
+
+This notice will be removed once the fixed release is in the tree.
+EOM
+}
+]