r/Ubuntu • u/gerardwx • 11h ago

news Update your PHP

There's an urgent update for PHP. Patch your systems if you're using it: https://ubuntu.com/security/notices/USN-8948-1

130 Upvotes

98% Upvoted

28 comments sorted by

21

u/YourTechSupport 11h ago

Trying to but the repo is getting hammered.

3

u/Lienart-Irving 9h ago

give it a bit, it should calm down soon

2

u/CarlosEduardoAraujo 6h ago

Yes, same situation here and you know what's the worst? It's not the first time this has happened, it's becoming a recurring situation. I need to update PHP and I'm getting this error. Bizarre situation!!

13

u/vincent_sch 11h ago

After the update you should check that the fix is in, because Ubuntu keeps the old upstream version number. zcat /usr/share/doc/php8.3-fpm/changelog.Debian.gz | head -20 lists the CVEs. Then restart php-fpm and long-running PHP workers like queue workers.

2

u/TheSentientMeatbag 7h ago

After many attempts, I finally got the server of our non-profit upgraded. It still runs Ubuntu 22.04 LTS and PHP 8.1.34, but no mention of these CVEs in the PHP changelog. The last entry in there is from July 3rd and so is the build. (PHP 8.4 is also installed, but not in use yet, its last changelog entry is from September 24th.)

Could this be a fix that doesn't require a new build or is this (like u/nicholasserra says) because we don't have Ubuntu Pro?

0

u/credditz0rz 6h ago

8.1.x is end of life and officially no longer receives security patches

3

u/nhaines 6h ago

Ubuntu 22.04 LTS is not end of life, does receive security updates from Canonical, and this issue is patched with the php8.1 version 8.1.2-1ubuntu2.28.

3

u/TheSentientMeatbag 6h ago

I know and we are planning to migrate, but the Ubuntu site says there is a fixed version available for Ubuntu 22.04 and PHP 8.1, see: https://ubuntu.com/security/CVE-2026-109619

That also says the fix is for PHP 8.1.2 for some reason. I find this confusing as PHP 8.1.34 is the most recent patch, why not fix that one? Same goes for other PHP versions: all the fixes seem to be for older patches.

It's getting late here, so I'm off to bed. I might try to install the 8.1.2-version tomorrow, but I'm not sure what that does with all the vulnerabilities that got fixed between version 8.1.2 and 8.1.34...

What a mess.

14

u/nicholasserra 10h ago

Need an ubuntu pro token for a security release, but the registration appears to be down :( Probably getting hammered. Kind of silly they're gating security patches behind a subscription, even if its free for personal.

8

u/nhaines 6h ago

Need an ubuntu pro token for a security release

No you don't. PHP is in the main repository and is fully supported. The fix for this--as very clearly outlined in the USN article in the post--is now available for Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 for all systems.

Ubuntu Pro is needed for fixes for Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, and 20.04 LTS, since they are all long past their original support windows.

5

u/nicholasserra 6h ago

I’m on 20.04. So ended up getting pro key and installed 7.4 security update from extended support registry

4

u/nhaines 6h ago

I'm glad you were able to get the key and all patched up!

3

u/nicholasserra 6h ago

I was surprised and impressed they did the 7.4 patch tbh. Was a simple update once I got my pro token. Good stuff!

5

u/Sr_P3ngu1n 7h ago

I’m trying to update, but everything is overloaded—pretty much everyone is trying to update. :(

3

u/PajamaPants4Life 9h ago

Just to clarify, did Ubuntu have backported patches? I see that they claim this is fixed in 8.5.4-0ubuntu1.5, but the fix is supposed to be in 8.5.12

3

u/nhaines 6h ago

Yes. This is how Debian operates, and how Ubuntu has operated for all 24 years it has existed.

3

u/OdionBuckley 7h ago

How do I do this? I am on Ubuntu 24.04. According to the link, the PHP 8.3 repo packages are updated. However, after running sudo apt update && sudo apt --only-upgrade install "*php*" and rebooting, phpinfo() continues to tell me I'm using 8.3.6 instead of 8.3.36. I'm not a computer genius and I need more details on what I'm supposed to do here.

4

u/ssddanbrown 7h ago

Ubuntu backported the patches to older PHP version, so you will still see 8.3.6 as a PHP version. I've shared some guidance here if it would help.

3

u/Silly_Guidance_8871 7h ago

Anyone else having issues fetching the updates from the ondrej ppa?

2

u/Technological_Pirate 7h ago

Yeah its not just you I am having that issue as well. 503 http error

2

u/CarlosEduardoAraujo 6h ago

Yes. Bizarre

3

u/choogbaloom 2h ago

Any options for ubuntu 20.04?

1

u/linmanfu 6m ago

You need Ubuntu Pro. It's free for IIRC up to five systems personal use.

4

u/latkahgravis 10h ago

Will sudo apt update do it?

10

u/PaulNM81 10h ago

That'll update the available package lists on your system, but you'll need apt upgrade or apt full-upgrade to actually install any updates.

3

u/Paulitow_ 11h ago

Why PHP sury repo have the fix for nearly all php version in ubuntu but not the official repo yet ?
https://ubuntu.com/security/CVE-2026-109619#status

8

u/SpookyKipper 11h ago

Ubuntu official builds are mostly based on sury builds.

Also, ubuntu official builds are actually out now for all supported LTS releases even backported to PHP 5.

Their CVE page just isn't updated.

https://ubuntu.com/blog/php2shell-vulnerability-fixes-available

4

u/Paulitow_ 11h ago

My man, thank you !