PHP, which stands for "PHP: Hypertext Preprocessor" is a widely-used Open
Source general-purpose scripting language that is especially suited for
Web development and can be embedded into HTML. Its syntax draws upon C,
Java, and Perl, and is easy to learn. The main goal of the language is to
allow web developers to write dynamically generated webpages quickly, but
you can do much more with PHP.
===> The following configuration options are available for php82-8.2.35_2:
CGI=on: Build CGI version
CLI=on: Build CLI version
DEBUG=off: Build with debugging support
DTRACE=on: Build with DTrace probes
EMBED=on: Build embedded library
FPM=on: Build FPM version
IPV6=on: IPv6 protocol support
LINKTHR=on: Link thread lib (for threaded extensions)
MYSQLND=on: Build with MySQL Native Driver
PCRE=on: Use system pcre instead of bundled one
PHPDBG=off: Interactive PHP debugger
ZTS=off: Force Zend Thread Safety (ZTS) build
===> Use 'make config' to modify these settings
SECURITY: session upload progress (CVE-2026-115560, informational)
php.ini-production and php.ini-development now ship with
session.upload_progress.enabled = 0 as a temporary mitigation until the
next regular PHP bugfix release. It only takes effect if you copy one of
these templates to /usr/local/etc/php.ini. Without a php.ini, the
compiled-in default (enabled) applies.
Applications that read $_SESSION["upload_progress_*"] (upload progress
bars) will stop receiving progress data while this is off.
If upgrading
SECURITY: session upload progress (CVE-2026-115560, informational)
Until the next regular PHP bugfix release, session.upload_progress.enabled
should be 0. The shipped php.ini-production and php.ini-development now
set it, but existing php.ini files are never modified on upgrade, and
with no php.ini the compiled-in default (enabled) applies. If you
already applied this setting for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp),
keep it; nothing further is needed.
The issue needs an unusual combination: session.serialize_handler set
to php_binary or php_serialize in configuration, switched to php at
runtime with ini_set() before session_start(), with upload progress
still enabled. Applications that never change the handler at runtime
can keep the feature enabled.
Check the effective value per SAPI (CLI and FPM/mod_php may load
different ini files):
php -r 'var_dump(ini_get("session.upload_progress.enabled"));'
For FPM/mod_php, use phpinfo() from a web request. Ini files are read
from /usr/local/etc/php.ini and /usr/local/etc/php/*.ini.
Check both halves of the precondition:
php -r 'var_dump(ini_get("session.serialize_handler"));'
grep -rn serialize_handler /usr/local/www /usr/local/etc/php* \
/usr/local/etc/apache2*
A match on one half alone is not vulnerable; the combination is. To
make runtime switching impossible in FPM, set in the pool config:
php_admin_value[session.serialize_handler] = php
This breaks applications that legitimately need php_serialize at runtime.
After changing any setting, restart the PHP service, e.g.:
service php_fpm restart
This notice will be removed once the fixed release is in the tree.
lang/php82: Disable session upload progress in shipped php.ini templates
Set session.upload_progress.enabled = 0 in php.ini-production and
php.ini-development as a temporary mitigation for CVE-2026-115560, until
the next regular upstream bugfix release. The issue requires an
application to set session.serialize_handler to php_binary or
php_serialize and switch it to php at runtime via ini_set() before
session_start(), with upload progress still enabled.
The templates only affect new installs and users who copy them to
php.ini; existing php.ini files are untouched. Add a pkg-message
describing the change and how to check the effective configuration.
Security: CVE-2026-115560
Changelog: https://www.php.net/ChangeLog-8.php#${NEW_VERSION}
(cherry picked from commit 438e512499a99559cf18ba9119dc3a534af3b2a4)
lang/php8*: Force fresh FreeBSD.org package builds.
No functional changes to the ports.
The packages were built manually today from a temporary branch to
incorporate the RCE fixes without triggering unnecessary rebuilds.
These fixes were cherry-picked onto the previous package build rather
than built from a published branch.
Bump the ports to trigger fresh builds from the published tree,
ensuring reproducibility and accurate package metadata.
MFH: 2026Q4
(cherry picked from commit 44fd248dd4d7337c7e3517d1852be9d3dfd6071c with
lmdb reference removed)
