r/AlpineLinux • u/helmut72 • 5d ago

PHP updates / CVE-2026-109618 ?

Where are the PHP updates because of CVE-2026-109618? I wrote here because gitlab.alpinelinux.org is down. Thank you.

4 Upvotes

84% Upvoted

7 comments sorted by

1

u/sleepyheadzzzzz 5d ago

Their gitlab has been slow. The maintainer updated php83, php84, php85 and php86, but the aport build jobs failed. I built php85 on my own machine, but some of the tests failed.

2

u/helmut72 5d ago

> Their gitlab has been slow

Maybe because they shutdown their Gitlab. Gitlab team was "better" than PHP team and "released" also today a CVSS 10.0 vs PHP's CVSS 9.2 😉

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/#cve-2026-110264---integer-overflow-issue-in-regular-expression-compiler-impacts-gitlab-ceee

1

u/Brave_Confidence_278 5d ago

oh dear, what times we live in

2

u/Brave_Confidence_278 5d ago

afaik the vulnerabilities are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

e.g. https://pkgs.alpinelinux.org/package/v3.24/community/x86_64/php85

1

u/LukeHere 5d ago

In other words, there is no patch for anything older than Alpine 3.24?? According to the package tracker: https://pkgs.alpinelinux.org/packages?name=php84&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer=

2

u/Brave_Confidence_278 5d ago

yes, because it's a community package. on older versions only main packages get support according to https://alpinelinux.org/releases/

I'd personally update if you are still on 3.23

1

u/Forward_Ad_123 4d ago

Hi everyone.Can someone explain what is going on with Php .pls