Open Source Development

Power Open Source Development

Explore the open source tools and capabilities for building and deploying modern applications on IBM Power platforms including AIX, IBM i, and Linux.


#Power


#Power


#Servers
#Opensource
 View Only

  • 1.  PHp security alert

    Posted 16 days ago

    Hello,

    Our security department has issued a security alert for php:

    On October 20, 2026, the PHP Foundation issued an advance notice regarding an unscheduled security update [1.3.3]. The release of the patches is scheduled for today, October 21, 2026, at 16:00 CEST (14:00 UTC) [1.3.1]. According to current reports and information from security authorities, the situation is as follows: Technical Details • Vulnerability Identifiers: CVE-2026-109618 and CVE-2026-109619 [1.2.4] (also discussed within technical circles in the context of a leaked exploit tool known as "PHP2Shell" [1.2.2, 1.4.5]). • Severity: CVSS v4.0: 9.2 (Critical) [1.3.3]. • Threat Potential: Enables Remote Code Execution (RCE), potentially without requiring prior authentication [1.2.4, 1.4.3]. • Scope: The vulnerabilities affect the PHP core itself (rather than the applications built upon it) [1.2.2]. Analyses by security researchers (including those at watchTowr and Sansec) indicate that the vulnerability potentially extends to all PHP versions from 5.x onwards [1.2.1, 1.2.5]. Official patches from the developer will be provided for all actively supported versions, starting from PHP 8.2 [1.2.1, 1.4.5].

    Will updates be made available for these products soon?
    Regards



    ------------------------------
    Stefan Martin
    ------------------------------


  • 2.  RE: PHp security alert

    Posted 15 days ago

    Hi Stefan,
    We are working on updating PHP to address these CVEs and the updated package will be published in AIX Toolbox soon.



    ------------------------------
    RESHMA KUMAR
    ------------------------------



  • 3.  RE: PHp security alert

    Posted 15 days ago
    Edited by Robert John 15 days ago

    Hi, is there a timeline until the new/updated packages will be available in the Toolbox for AIX?
    Edit: And will there be an update for both versions php7 and 8 ?

    Regards, Robert



    ------------------------------
    Robert John
    ------------------------------

    Original Message


  • 4.  RE: PHp security alert

    Posted 15 days ago

    Hi Robert,
    We will be publishing the updated php package(8.5.12) in 2-3 days. 
    There will be no update for php7



    ------------------------------
    RESHMA KUMAR
    ------------------------------

    Original Message


  • 5.  RE: PHp security alert

    Posted 13 days ago

    PHP 8.5.12 is now available in AIX Toolbox. 
    Please use DNF to update to this version. 



    ------------------------------
    RESHMA KUMAR
    ------------------------------

    Original Message


  • 6.  RE: PHp security alert

    Posted 11 days ago

    Hello, thanks for the information.

    But why will there be no update for php7 in the Toolbox? ? Other vendors provide that as well based on a fixed version  7.4.33 .. such as RedHat, SUSE, Oracle.

    A migration of all php programs to version 8 can be very hard and time-consuming.... if it is originally written for php7.

    SUSE: php7-7.4.33-150400.4.81.1

    RHEL: php-7.4.33-8.module+el8.10.0+25117+30337cca

    OL: php-7.4.33-8.module+el8.10.0+91080+9785160d

    Regards, Robert



    ------------------------------
    Robert John
    ------------------------------

    Original Message


  • 7.  RE: PHp security alert

    Posted 8 days ago
    Edited by Joshua Strodtbeck 8 days ago

    Robert, PHP 7 has been out of support by the community since 2022. RHEL and SUSE maintain their own streams as part of their extended lifecycle support, which is a paid service they offer. AIX Toolbox is free to AIX users, so we track community support on the packages we maintain. To keep systems secure, it is essential that you plan your software migrations before the end of support.



    ------------------------------
    Joshua Strodtbeck
    ------------------------------

    Original Message


Related Content