r/freebsd • u/reviewmynotes • 1h ago

PHP on pkg

If I install PHP via pkg but now have to upgrade it a.s.a.p. to a version not yet in the quarterly pkg packages, what is the recommended path? Just uninstall and then use ports (cd /usr/ports/... && make world)?

5 Upvotes

78% Upvoted

7 comments sorted by

•

u/grahamperrin bleep bloop 18m ago

Also, please note the pinned post – there's discussion of packages and availability:

PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert

2

u/foreverlarz 1h ago

i also had php84 installed via packages. so earlier today i did this:

doas pkg audit -F # should list php84 df -h /usr # need ~2 GB free ls -a /usr/ports # missing or empty → clone; has .git → pull doas git clone --depth 1 https://git.FreeBSD.org/ports.git /usr/ports # or: doas git -C /usr/ports pull make -C /usr/ports/lang/php84 -V PKGVERSION # must print 8.4.27 doas pkg upgrade -n # should only list upgrades but not a php84 upgrade doas pkg upgrade # upgrade them cd /usr/ports/lang/php84 doas make install-missing-packages # install dependencies doas make build # build the php port doas make stage doas make deinstall install clean pkg info -e mod_php84 && echo mod_php || echo fpm doas service apache24 restart # if mod_php doas service php_fpm restart # if fpm php -v # should be 8.4.27 now doas pkg audit -F # php84 and curl gone

or something like that

1

u/IllustriousRaccoon25 1h ago

Yup, and also mod_php if you are using it with Apache. We rebuilt all PHP modules we were using from pkg as well, just out of paranoia. We started this as soon as ports got updated, which I think was around 11:15am EDT.

Disappointed to see no FreeBSD security bulletin about this, even though they did get one out for the compromised certificate authority.

2

u/grahamperrin bleep bloop 17m ago

Disappointed to see no FreeBSD security bulletin about this,

PHP is not a feature of FreeBSD.

2

u/laffer1 MidnightBSD project lead 1h ago

Setup mod security also. It blocked 8 attempts to get into one of my servers before the php patch was released

2

u/reviewmynotes 1h ago

Nice tip. Thank you. I'll check that out. Was it difficult to set up?

2

u/laffer1 MidnightBSD project lead 1h ago

It’s a bit of a headache to get the rules setup well for a specific site. There is a way to turn off specific rules. It’s saved me a few times though

An ai agent can help you configure it in a pinch.