PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario…
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being r…
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33…
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8…
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of…
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger…
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect …
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap…
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33…
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requ…
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFF…
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL s…
lang/php84: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
lang/php8*: Force fresh FreeBSD.org package builds.
No functional changes to the ports.
The packages were built manually today from a temporary branch to
incorporate the RCE fixes without triggering unnecessary rebuilds.
These fixes were cherry-picked onto the previous package build rather
than built from a published branch. The cherry-picks also omitted the
lmdb change in 85ba298b7e0.
Bump the ports to trigger fresh builds from the published tree,
ensuring reproducibility and accurate package metadata.
MFH: 2026Q4
databases/lmdb: allow to install both 0.x and 1.x together
LMDB 1.0 and the legacy 0.9 ABI cannot be mixed, the datanase format are
incompatibles as well.
Rename or relocate everything databases/lmdb0 installs so that it no
longer overlaps with databases/lmdb:
- the utilities are now mdb_copy0, mdb_dump0, mdb_load0 and mdb_stat0
- the header is include/lmdb0/lmdb.h
- the linker name is liblmdb0.so, the shared object keeps its ABI name
liblmdb.so.0 so already linked programs are unaffected
- the pkg-config file is lmdb0.pc
A compatibility prefix holding the previous layout is also installed
under ${PREFIX}/lmdb0/ (include/, lib/ and libdata/pkgconfig/) so that
build systems which expect to find lmdb.h and -llmdb relative to a
single directory only need a path change.
Now all ports should migrate to lmdb 1.X and use the lmdb 0.9 port to ease
in the migration path, lmdb, the lmdb 0.x is supposed to get removed at
some point.
Approved by: mat (portmgr)
Reviewed by: mat
Differential Revision: https://reviews.freebsd.org/D60741
databases/lmdb0: Add port for LMDB 0.9.x legacy ABI
LMDB 1.0 introduced an incompatible on-disk format change and subtle
API breakage: applications that compiled cleanly against 1.0 headers
could fail silently at run time. Known affected ports include dns/knot3,
mail/bogofilter, and mail/postfix; the postfix issue has been confirmed
upstream. Linux distributions such as Arch Linux have observed the same
breakage. Samba can also be affected in certain configurations.
Because the regression is not detectable in an -exp build run -- the
postfix failure only manifests at run time, and bogofilter was caught
only because post-build self-tests happen to exercise this path -- we
cannot rely on package builds to validate the 1.0 upgrade.
This commit introduces databases/lmdb0 as a holding port for the 0.9.35
release, pinned to the 0.x branch with PORTSCOUT=limit:^0. and mutually
conflicting with databases/lmdb, which retains 1.0. The two packages
cannot be installed simultaneously, but having lmdb0 available means:
* Ports known to require the 0.9 ABI can declare an explicit dependency
on databases/lmdb0 until they are validated against 1.0.
* Users with existing databases in the 0.9 format can still access the
mdb_dump and mdb_load utilities to migrate data before upgrading.
* The package conflict prevents accidental mixing.
All 50 direct dependents of databases/lmdb are redirected to
databases/lmdb0 for now with a PORTREVISION bump, effectively restoring
the tree to the state prior to the LMDB 1.0 update. Once all dependent
ports are validated against LMDB 1.0, they will be moved back to
databases/lmdb and databases/lmdb0 will be removed.
PR: ports/296530
*/*php86*: Sunrise
Please DO NOT use this version in production, it is an early test version.
For upgrade notes please visit:
https://github.com/php/php-src/blob/php-8.6.0alpha1/UPGRADING
Changelog: https://github.com/php/php-src/blob/php-8.6.0alpha1/NEWS
lang/php84: Update version 8.4.20=>8.4.21
- Optionize JIT. JIT for opcache has been disabled by default. Make it
and option to conditionally depend on capstone [1]
Changelog: https://www.php.net/ChangeLog-8.php#8.4.21
PR: 294233 [1]
Reported by: chris@chrullrich.net [1]
MFH: 2026Q2
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
lang/php84: fix build with LibreSSL
sk_X509_new_reserve does not exist in LibreSSL, only OpenSSL.
Obtained from: OpenBSD ports
Approved by: bofh (maintainer)
Differential Revision: https://reviews.freebsd.org/D55921
lang/php84: use bundled argon only on base win OpenSSL 3.5+
OpenSSL 3.5 introduced in base at 1500059
MFH: 2026Q1
Approved by: portbgr blanket (fix build)
*/*php85*: Sunrise
Please DO NOT use this version in production, it is an early test
version.
For upgrade notes please visit:
https://github.com/php/php-src/blob/php-8.5.0alpha1/UPGRADING
Changelog: https://github.com/php/php-src/blob/php-8.5.0alpha1/NEWS
lang/php84: Correct php_fpm in rc.d script
Correct a reference in the php_fpm.in file, changing php-fpm to php_fpm to
ensure consistent naming when invoking the rc.d script for PHP-FPM profiles.
PR: 285584
www/php84-opcache: fix build on non-amd64 / non-i386
post-configure step unconditionally tried to use JIT source, even when JIT was
disabled in ports (on aarch64) or in the source (powerpc*, riscv*, armv7),
which caused build breakage.
This commit checks whether JIT is supported (currently it is only on aarch64,
amd64 and i386) and only then uses JIT sources.
It also enables JIT on aarch64, which was disabled previously.
lang/php84: Update version 8.4.0RC3=>8.4.0RC4
Please DO NOT use this version in production, it is an early test
version.
Changelog: https://github.com/php/php-src/blob/php-8.4.0RC4/NEWS
lang/php84: Update version 8.4.0RC2=>8.4.0RC3
Please DO NOT use this version in production, it is an early test
version.
Changelog: https://github.com/php/php-src/blob/php-8.4.0RC3/NEWS
lang/php84: Update version 8.4.0RC1=>8.4.0RC2
Please DO NOT use this version in production, it is an early test
version.
Changelog: https://github.com/php/php-src/blob/php-8.4.0RC2/NEWS
lang/php84: Update version 8.4.0beta5=>8.4.0RC1
Please DO NOT use this version in production, it is an early test version.
Changelog: https://github.com/php/php-src/blob/php-8.4.0RC1/NEWS
lang/php84: Update version 8.4.0beta4 => 8.4.0beta5
Please DO NOT use this version in production, it is an early test version.
Changelog: https://github.com/php/php-src/blob/php-8.4.0beta5/NEWS
lang/php84: Update version 8.4.0beta3=>8.4.0beta4
Please DO NOT use this version in production, it is an early test
version.
Changelog: https://github.com/php/php-src/blob/php-8.4.0beta4/NEWS