php security update notice
69 views
Skip to first unread message
David McKenna
Oct 22, 2026, 4:56:16 PMOct 22
to Apache for OS/2
Heads-up: There is a new security update for php that is considered critical to prevent remote code execution, particularly with mod_php, that affects all versions of php. Here is how to partially mitigate (but only an update will totally mitigate it):
- For the OOM Flaw (CVE-2026-109618): Set memory_limit = -1 administratively in your FPM pool or Apache configuration. This disables PHP's per-request cap and removes the predictable memory failure pathway used by known exploits. (Ensure your system has sufficient RAM/swap to prevent operating system-level crashes). [1]
- For the Session Path Flaw (CVE-2026-109619): Set session.upload_progress.enabled = 0 in your global php.ini. This must be done at the server configuration level; application-level ini_set() calls occur too late to prevent the exploit. [1]
- Restart Workers: You must restart your web server or PHP-FPM daemon for any of these configuration changes or patches to take effect. [1]
Massimo S.
Oct 23, 2026, 3:07:25 AMOct 23
to apa...@googlegroups.com
Il 22/10/2026 22:56, David McKenna ha scritto:
> Heads-up: There is a new security update for php that is considered critical to prevent remote code
> execution, particularly with mod_php, that affects all versions of php. Here is how to partially mitigate (but
> only an update will totally mitigate it):
>
> * *For the OOM Flaw (CVE-2026-109618):* Set memory_limit = -1 administratively in your FPM pool or Apache
> Heads-up: There is a new security update for php that is considered critical to prevent remote code
> execution, particularly with mod_php, that affects all versions of php. Here is how to partially mitigate (but
> only an update will totally mitigate it):
>
> configuration. This disables PHP's per-request cap and removes the predictable memory failure pathway used
> by known exploits. /(Ensure your system has sufficient RAM/swap to prevent operating system-level
> crashes)/.[1
> <https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/>]
> * *For the Session Path Flaw (CVE-2026-109619):* Set session.upload_progress.enabled = 0 in your global
> php.ini. This must be done at the server configuration level; application-level ini_set() calls occur too
> late to prevent the exploit.[1
> <https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/>]
> late to prevent the exploit.[1
> * *Restart Workers:*You *must restart*your web server or PHP-FPM daemon for any of these configuration
> changes or patches to take effect.[1
> <https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/>]
Hi all,
here i've apache 2.4.61 (2.4.63 have issues so i can't upgrade it) with php or even the
one without php that probably is receving some sort of attack, since it exit about 3-4
times per day it do not restart anymore and the fault-daemon reboot the VMs.
If the attackers are using some security flaw of 2.4.61 we are fuc$ed since we don't have a newer web server.
Paul has allmost abandoned the development.
Andrey use its own web server.
It seems that i'm the only one /2 content ISP left, i guess everyone has moved to other OSes.
massimo
Paul Smedley
Oct 23, 2026, 3:19:30 AMOct 23
to apa...@googlegroups.com
Hey folks,
I thought I replied to Dave's message this morning, but I have nothing
in my sent items and there's nothing in my draft's either.
My health is not great, so it is not correct to say I've abandoned
development. If there was a *critical* security flaw for apache, I would
do my best to build an update. That said, there does come a time where
there are so few users that it does seem pointless...
Anyways, back to the topic of Dave's message.
What versions are folks using?
I know Lewis and Max are using 7.4.x and understand why - and I think
I've seen a patch file for 7.4 for the exploit.
Others that are on 8.x - it looks like I've previously build 8.1, 8.2
and 8.3 - both 8.2 and 8.3 have patches available. Is anyone using 8.2.x
or 8.3.x and they're running OK? My preference here would be to 'just'
bump 8.3.x to the latest with the exploit fixed and same with 7.4.x.
Cheers,
Paul
in my sent items and there's nothing in my draft's either.
My health is not great, so it is not correct to say I've abandoned
development. If there was a *critical* security flaw for apache, I would
do my best to build an update. That said, there does come a time where
there are so few users that it does seem pointless...
Anyways, back to the topic of Dave's message.
What versions are folks using?
I know Lewis and Max are using 7.4.x and understand why - and I think
I've seen a patch file for 7.4 for the exploit.
Others that are on 8.x - it looks like I've previously build 8.1, 8.2
and 8.3 - both 8.2 and 8.3 have patches available. Is anyone using 8.2.x
or 8.3.x and they're running OK? My preference here would be to 'just'
bump 8.3.x to the latest with the exploit fixed and same with 7.4.x.
Cheers,
Paul
Lewis G Rosenthal
Oct 23, 2026, 9:04:45 AMOct 23
to apa...@googlegroups.com
Good morning from this side of the globe, my friend...
On 10/23/26 03:19 am, Paul Smedley wrote:
> Hey folks,
>
> On 23/10/26 17:37, 'Massimo S.' via Apache for OS/2 wrote:
>> Il 22/10/2026 22:56, David McKenna ha scritto:
>>> Heads-up: There is a new security update for php that is considered
>>> critical to prevent remote code execution, particularly with mod_php,
>>> that affects all versions of php. Here is how to partially mitigate (but
>>> only an update will totally mitigate it):
<snip>
> I thought I replied to Dave's message this morning, but I have nothing in
> my sent items and there's nothing in my draft's either.
>
> My health is not great, so it is not correct to say I've abandoned
> development. If there was a *critical* security flaw for apache, I would
> do my best to build an update. That said, there does come a time where
> there are so few users that it does seem pointless...
>
> Anyways, back to the topic of Dave's message.
>
> What versions are folks using?
>
> I know Lewis and Max are using 7.4.x and understand why - and I think I've
> seen a patch file for 7.4 for the exploit.
>
I am running 5.4.40 on OS/2 under Apache 2.2 these days. Everything else is
running on Linux. I plan on implementing the recommended mitigations as best
I can (I have to think as to how disabling uploads might impact net2ftp,
which requires login before uploading, anyway).
If there is a patch for 5.4 available, that would be helpful. At this point,
any major Apache/PHP upgrades here are likely to be on hold until next May.
> Others that are on 8.x - it looks like I've previously build 8.1, 8.2 and
> 8.3 - both 8.2 and 8.3 have patches available. Is anyone using 8.2.x or
> 8.3.x and they're running OK? My preference here would be to 'just' bump
> 8.3.x to the latest with the exploit fixed and same with 7.4.x.
>
That seems a sane approach.
Thanks for all you continue to do, Paul.
--
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS, EA
Rosenthal & Rosenthal, LLC www.2rosenthals.com
visit my IT blog www.2rosenthals.net/wordpress
-------------------------------------------------------------
On 10/23/26 03:19 am, Paul Smedley wrote:
> Hey folks,
>
> On 23/10/26 17:37, 'Massimo S.' via Apache for OS/2 wrote:
>> Il 22/10/2026 22:56, David McKenna ha scritto:
>>> Heads-up: There is a new security update for php that is considered
>>> critical to prevent remote code execution, particularly with mod_php,
>>> that affects all versions of php. Here is how to partially mitigate (but
>>> only an update will totally mitigate it):
> I thought I replied to Dave's message this morning, but I have nothing in
> my sent items and there's nothing in my draft's either.
>
> My health is not great, so it is not correct to say I've abandoned
> development. If there was a *critical* security flaw for apache, I would
> do my best to build an update. That said, there does come a time where
> there are so few users that it does seem pointless...
>
> Anyways, back to the topic of Dave's message.
>
> What versions are folks using?
>
> I know Lewis and Max are using 7.4.x and understand why - and I think I've
> seen a patch file for 7.4 for the exploit.
>
running on Linux. I plan on implementing the recommended mitigations as best
I can (I have to think as to how disabling uploads might impact net2ftp,
which requires login before uploading, anyway).
If there is a patch for 5.4 available, that would be helpful. At this point,
any major Apache/PHP upgrades here are likely to be on hold until next May.
> Others that are on 8.x - it looks like I've previously build 8.1, 8.2 and
> 8.3 - both 8.2 and 8.3 have patches available. Is anyone using 8.2.x or
> 8.3.x and they're running OK? My preference here would be to 'just' bump
> 8.3.x to the latest with the exploit fixed and same with 7.4.x.
>
Thanks for all you continue to do, Paul.
--
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS, EA
Rosenthal & Rosenthal, LLC www.2rosenthals.com
visit my IT blog www.2rosenthals.net/wordpress
-------------------------------------------------------------
David McKenna
Oct 23, 2026, 9:20:15 AMOct 23
to Apache for OS/2
Hi Paul!
I'm currently using your php 8.1 with latest Apache2 mostly without trouble, but lately (last couple of months) have had strange 'attacks' that crash the server. Maybe related to this exploit? Anyway, if your health allows it, it would be great if you could get a new php 8.3 version working. That is what Wordpress currently wants as a minimum. I remember you worked on it for a while, but had some kind of trouble with random number generation? I should dig it out and try 8.3 again...
Hope things get better for you Paul. Keep on growing.
Regards,
Massimo S.
Oct 23, 2026, 9:24:45 AMOct 23
to apa...@googlegroups.com
Il 23/10/2026 15:20, David McKenna ha scritto:
> Hi Paul!
>
> I'm currently using your php 8.1 with latest Apache2
Hi,
> Hi Paul!
>
> I'm currently using your php 8.1 with latest Apache2
2.4.61 or 2.4.63?
massmimo
> visit my IT blog www.2rosenthals.net/wordpress <http://www.2rosenthals.net/wordpress>
> -------------------------------------------------------------
>
> --
> You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to
> apache2+u...@googlegroups.com <mailto:apache2+u...@googlegroups.com>.
> To view this discussion visit
> https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com
> <https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com?utm_medium=email&utm_source=footer>.
Zdenek Wagner
Oct 23, 2026, 9:32:28 AMOct 23
to apa...@googlegroups.com
Hi,
if you look at www.php.net, you will see
<quote>
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities
that can allow unauthenticated remote code execution. All PHP users
are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including
PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We
consider the risk highest for mod_php, with a demonstrated exploit
where an unauthenticated request can trigger the attack before any
application code runs.
...
Given the severity of these vulnerabilities, the PHP security team
provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
help people building from source or without access to an LTS vendor.
</quote>
I am not sure whether it is enought to require authorization. The
vulnerability abuses a bug in memory allocation. If a resource
requires authorization, the server still has to read the
unauthenticated request and respond with status 401. The client then
has to respond with the appropriate authentication method. This means
that even without authentication an attacker can probably abuse that
bug. You should probably modify your php.ini as explained on the PHP
web and in the previous mail.
Zdeněk Wagner
https://www.zdenek-wagner.eu/
pá 23. 10. 2026 v 15:24 odesílatel 'Massimo S.' via Apache for OS/2
<apa...@googlegroups.com> napsal:
> To unsubscribe from this group and stop receiving emails from it, send an email to apache2+u...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/apache2/94a5c49d-a073-c914-f6c3-03c91e93a331%40ecomstation.it.
if you look at www.php.net, you will see
<quote>
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities
that can allow unauthenticated remote code execution. All PHP users
are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including
PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We
consider the risk highest for mod_php, with a demonstrated exploit
where an unauthenticated request can trigger the attack before any
application code runs.
...
Given the severity of these vulnerabilities, the PHP security team
provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
help people building from source or without access to an LTS vendor.
</quote>
I am not sure whether it is enought to require authorization. The
vulnerability abuses a bug in memory allocation. If a resource
requires authorization, the server still has to read the
unauthenticated request and respond with status 401. The client then
has to respond with the appropriate authentication method. This means
that even without authentication an attacker can probably abuse that
bug. You should probably modify your php.ini as explained on the PHP
web and in the previous mail.
Zdeněk Wagner
https://www.zdenek-wagner.eu/
pá 23. 10. 2026 v 15:24 odesílatel 'Massimo S.' via Apache for OS/2
<apa...@googlegroups.com> napsal:
> To view this discussion visit https://groups.google.com/d/msgid/apache2/94a5c49d-a073-c914-f6c3-03c91e93a331%40ecomstation.it.
Lewis G Rosenthal
Oct 23, 2026, 9:47:04 AMOct 23
to apa...@googlegroups.com
Hi...
Thanks for this additional clarification, Zdenek. This confirms my thinking
that net2ftp's login requirement is not a consideration.
--
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS, EA
Rosenthal & Rosenthal, LLC www.2rosenthals.com
that net2ftp's login requirement is not a consideration.
--
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS, EA
Rosenthal & Rosenthal, LLC www.2rosenthals.com
visit my IT blog www.2rosenthals.net/wordpress
-------------------------------------------------------------
David McKenna
Oct 23, 2026, 1:05:00 PMOct 23
to Apache for OS/2
Massimo,
I'm using Apache 2.4.61.
Regards,
Massimo S.
Oct 23, 2026, 1:28:15 PMOct 23
to apa...@googlegroups.com
Il 23/10/2026 19:04, David McKenna ha scritto:
> Massimo,
>
> I'm using Apache 2.4.61.
>
> Regards,
Do you have the situation of apache sometime exiting in this way?
> Massimo,
>
> I'm using Apache 2.4.61.
>
> Regards,
[Fri Oct 23 15:58:37.875000 2026] [mpm_mpmt_os2:notice] [pid 4240:tid 1] (OS 10035)Resource temporarily
unavailable: apr_socket_accept
[Fri Oct 23 16:18:29.596000 2026] [core:error] [pid 3483:tid 1] (13)Permission denied: AH00095: failed to
remove PID file X:/apache/logs/httpd.pid
[Fri Oct 23 16:18:29.596000 2026] [mpm_mpmt_os2:notice] [pid 3483:tid 1] AH00201: caught SIGTERM, shutting down
massimo
> > visit my IT blog www.2rosenthals.net/wordpress <http://www.2rosenthals.net/wordpress>
> <http://www.2rosenthals.net/wordpress>
> > -------------------------------------------------------------
> >
> > --
> > You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to
> > apache2+u...@googlegroups.com <mailto:apache2+u...@googlegroups.com>.
> > To view this discussion visit
> > https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com
> >
> <https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com?utm_medium=email&utm_source=footer>.
>
>
> --
> You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to
> apache2+u...@googlegroups.com <mailto:apache2+u...@googlegroups.com>.
> To view this discussion visit
> https://groups.google.com/d/msgid/apache2/d31581d8-5745-4433-97fa-69118d34caa8n%40googlegroups.com
> <http://www.2rosenthals.net/wordpress>
> > -------------------------------------------------------------
> >
> > --
> > You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to
> > apache2+u...@googlegroups.com <mailto:apache2+u...@googlegroups.com>.
> > To view this discussion visit
> > https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com
> >
> <https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com?utm_medium=email&utm_source=footer>.
>
>
> --
> You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to
> apache2+u...@googlegroups.com <mailto:apache2+u...@googlegroups.com>.
> To view this discussion visit
> <https://groups.google.com/d/msgid/apache2/d31581d8-5745-4433-97fa-69118d34caa8n%40googlegroups.com?utm_medium=email&utm_source=footer>.
Massimo S.
Oct 23, 2026, 2:26:56 PMOct 23
to apa...@googlegroups.com
Il 23/10/2026 19:28, 'Massimo S.' via Apache for OS/2 ha scritto:
> Il 23/10/2026 19:04, David McKenna ha scritto:
>> Massimo,
>>
>> I'm using Apache 2.4.61.
>>
>> Regards,
>
>
> Do you have the situation of apache sometime exiting in this way?
>
> [Fri Oct 23 15:58:37.875000 2026] [mpm_mpmt_os2:notice] [pid 4240:tid 1] (OS 10035)Resource temporarily
> unavailable: apr_socket_accept
>
> [Fri Oct 23 16:18:29.596000 2026] [core:error] [pid 3483:tid 1] (13)Permission denied: AH00095: failed to
> remove PID file X:/apache/logs/httpd.pid
>
> [Fri Oct 23 16:18:29.596000 2026] [mpm_mpmt_os2:notice] [pid 3483:tid 1] AH00201: caught SIGTERM, shutting down
>
> massimo
Doh.. :D
> Il 23/10/2026 19:04, David McKenna ha scritto:
>> Massimo,
>>
>> I'm using Apache 2.4.61.
>>
>> Regards,
>
>
> Do you have the situation of apache sometime exiting in this way?
>
> [Fri Oct 23 15:58:37.875000 2026] [mpm_mpmt_os2:notice] [pid 4240:tid 1] (OS 10035)Resource temporarily
> unavailable: apr_socket_accept
>
> [Fri Oct 23 16:18:29.596000 2026] [core:error] [pid 3483:tid 1] (13)Permission denied: AH00095: failed to
> remove PID file X:/apache/logs/httpd.pid
>
> [Fri Oct 23 16:18:29.596000 2026] [mpm_mpmt_os2:notice] [pid 3483:tid 1] AH00201: caught SIGTERM, shutting down
>
> massimo
I guess you don't have this situation since i've discovered that's my rexx fault daemon
that process apache status and kill it if it find >59 requests, i've found also the
changelog and i did this against slow loris attacks in January 2018.
I will tune that number, since today it killed apache with 62 requests with 27 idle workers available, guess
nothing to worry about today..
Paul Smedley
Oct 24, 2026, 12:30:45 AMOct 24
to apa...@googlegroups.com
Hey Dave,
As the quick/easy/safe fix, I'll just update 8.1 with the fix from https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619
Cheers,
Pal
--
You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
To unsubscribe from this group and stop receiving emails from it, send an email to apache2+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com.
Paul Smedley
Oct 24, 2026, 7:46:28 AMOct 24
to apa...@googlegroups.com
OK for now....
php7.dll for PHP 7.4.32 - TBD - I forgot to regenerate configure, so failed to get a DLL, so it will have to wait until morning now.
php.dll for PHP 8.1.32 - https://smedley.id.au/tmp/php-8.1.32-dll-20261024-php2shell.zip
NB: neither of these DLLs has been tested
@Dave if you can help me remember what was wrong with the 8.3 builds I can look at those too.
I have also been asking Gemini's latest Argon AI model to look at the OS/2 APR code (https://share.gemini.google/ocrKySHSJjLE) and also the MPM code (https://share.gemini.google/Bh3KOBzM4tvR) within Apache for code improvements and it has a bunch of suggestions, so I just need to find the motivation to implement and test those.
Cheers,
Paul
On 23/10/26 23:50, David McKenna wrote:
Massimo S.
Oct 24, 2026, 8:06:42 AMOct 24
to apa...@googlegroups.com
Il 24/10/2026 13:46, Paul Smedley ha scritto:
> OK for now....
>
> php7.dll for PHP 7.4.32 - TBD - I forgot to regenerate configure, so failed to get a DLL, so it will have to
> wait until morning now.
>
> php.dll for PHP 8.1.32 - https://smedley.id.au/tmp/php-8.1.32-dll-20261024-php2shell.zip
>
> NB: neither of these DLLs has been tested
>
> @Dave if you can help me remember what was wrong with the 8.3 builds I can look at those too.
>
> I have also been asking Gemini's latest Argon AI model to look at the OS/2 APR code
> (https://share.gemini.google/ocrKySHSJjLE) and also the MPM code (https://share.gemini.google/Bh3KOBzM4tvR)
> within Apache for code improvements and it has a bunch of suggestions, so I just need to find the motivation
> to implement and test those.
>
> Cheers,
>
> Paul
Hi Paul,
> OK for now....
>
> php7.dll for PHP 7.4.32 - TBD - I forgot to regenerate configure, so failed to get a DLL, so it will have to
> wait until morning now.
>
> php.dll for PHP 8.1.32 - https://smedley.id.au/tmp/php-8.1.32-dll-20261024-php2shell.zip
>
> NB: neither of these DLLs has been tested
>
> @Dave if you can help me remember what was wrong with the 8.3 builds I can look at those too.
>
> I have also been asking Gemini's latest Argon AI model to look at the OS/2 APR code
> (https://share.gemini.google/ocrKySHSJjLE) and also the MPM code (https://share.gemini.google/Bh3KOBzM4tvR)
> within Apache for code improvements and it has a bunch of suggestions, so I just need to find the motivation
> to implement and test those.
>
> Cheers,
>
> Paul
very good to hear.
Thanks for the support.
massimo
>> visit my IT blog www.2rosenthals.net/wordpress <http://www.2rosenthals.net/wordpress>
>> -------------------------------------------------------------
>>
>> --
>> You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
>> To unsubscribe from this group and stop receiving emails from it, send an email to
>> apache2+u...@googlegroups.com.
>> To view this discussion visit
>> https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com
>> <https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com?utm_medium=email&utm_source=footer>.
>>
>> --
>> You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
>> To unsubscribe from this group and stop receiving emails from it, send an email to
>> apache2+u...@googlegroups.com.
>> To view this discussion visit
>> https://groups.google.com/d/msgid/apache2/0c197c15-edb3-4583-9666-f4af8df73ee0n%40googlegroups.com
>
> --
> You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to
> apache2+u...@googlegroups.com <mailto:apache2+u...@googlegroups.com>.
> --
> You received this message because you are subscribed to the Google Groups "Apache for OS/2" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to
> To view this discussion visit
> https://groups.google.com/d/msgid/apache2/131f64c8-8b3f-4355-adef-eee81559eb6e%40smedley.id.au
> <https://groups.google.com/d/msgid/apache2/131f64c8-8b3f-4355-adef-eee81559eb6e%40smedley.id.au?utm_medium=email&utm_source=footer>.
David McKenna
Oct 24, 2026, 11:43:18 AMOct 24
to Apache for OS/2
Hey Paul,
I tried your new php 8.1. Apache starts fine with it, and non=php pages display, but any php webpage I try to load hangs while 'performing a TLS handshake'. The php error log is clean, but the apache log has a long list of identical traps. I'll attach the log and one of the trap files.
Regards,
Paul Smedley
Oct 24, 2026, 8:39:02 PMOct 24
to apa...@googlegroups.com
Hey Dave,
Why did I know it wouldn't be this easy? Once I get 7.4.x built, I'll do a full rebuild of 8.1 and aim to do some local testing, and see if I an reproduce.
Cheers,
Paul
To view this discussion visit https://groups.google.com/d/msgid/apache2/721477a2-89cb-425c-a59d-cd8034320146n%40googlegroups.com.
Paul Smedley
Oct 25, 2026, 12:09:45 AMOct 25
to apa...@googlegroups.com
PHP7.dll is at php-7.4.32-dll-20261024-php2shell.zip - not tested yet either... trying to resurrect my virtualbox setup that as an AMP setup...
Paul Smedley
Oct 25, 2026, 5:55:28 AMOct 25
to apa...@googlegroups.com
OK...
VERY light testing but 7.4.x is able to render an older copy of my mantis site with no apparent problems...
8.1.x however is fubar... Couple of TRPs attached which are VERY different to Dave's... I'm going to have to go though my application of the patches very carefully and make sure I didn't mess them up. There were a lot of patch failures as the patches messed with lots of files that already had OS/2 specific patches in them, so lots of manually applied patches, which is lots of potential for error :(
The Fault - Limit Access Fault rings a bell - SSE2 perhaps??
Cheers,
Massimo S.
Oct 26, 2026, 5:00:14 PM (13 days ago) Oct 26
to apa...@googlegroups.com
Il 25/10/2026 10:55, Paul Smedley ha scritto:
> OK...
>
> VERY light testing but 7.4.x is able to render an older copy of my mantis site with no apparent problems...
Hi Paul,
> OK...
>
> VERY light testing but 7.4.x is able to render an older copy of my mantis site with no apparent problems...
https://smedley.id.au/tmp/php-7.4.32-dll-20261024-php2shell.zip
it seems to work, i'm testing it on the roundcube webmail.
massimo
Paul Smedley
Oct 26, 2026, 7:33:43 PM (13 days ago) Oct 26
to 'Massimo S.' via Apache for OS/2
Thanks Max,
Fwiw, I patched PHP to 8.1.34 then applied the php2shell fix and am working through getting it built. I don't think I'd previously built php on my bare metal machine.
I'll hopefully have a build ready for testing today.
Cheers
Paul.
Fwiw, I patched PHP to 8.1.34 then applied the php2shell fix and am working through getting it built. I don't think I'd previously built php on my bare metal machine.
I'll hopefully have a build ready for testing today.
Cheers
Paul.
Cheers,
Paul
Paul
Paul Smedley
Oct 26, 2026, 9:13:14 PM (13 days ago) Oct 26
to 'Massimo S.' via Apache for OS/2
VERY lightly tested, but appears to work with Apache2 v2.4.61 - https://smedley.id.au/tmp/php-8.1.34-os2-20261027.zip
David McKenna
Oct 27, 2026, 6:19:59 AM (13 days ago) Oct 27
to Apache for OS/2
Thanks Paul! This new php 8.1.34 seems to work great. Wordpress, phpMyAdmin and Filegator all work just fine with it. I have one request - awhile ago you had bulit an imagick.dll module (used by Wordpress) for php 8.1 using an old version of Image Magick. In the meantime, BWW released a newer version on their rpm site. Was wondering if you could build a newer imagick.dll module using the newer BWW version of Image Magick?
Regards,
Paul Smedley
Oct 27, 2026, 6:26:49 AM (13 days ago) Oct 27
to apa...@googlegroups.com
I'll try take a look at it tomorrow afternoon - it should be easy.
Cheers,
Paul
Paul
Paul Smedley
Oct 27, 2026, 10:46:06 PM (12 days ago) Oct 27
to apa...@googlegroups.com
Hi Dave,
LOL, it was famous last words.
1) replicated the last build I did - first issue was:
In file included from
c:/usr/include/ImageMagick-7/wand/MagickWand.h:29,
from php_imagick_defs.h:29,
from imagick_class.c:22:
c:/usr/include/ImageMagick-7/MagickCore/magick-config.h:63:3:
warning: #warning "you should set MAGICKCORE_QUANTUM_DEPTH to
sensible default set it to configure time default" [-Wcpp]
63 | # warning "you should set MAGICKCORE_QUANTUM_DEPTH to
sensible default set it to configure time default"
| ^~~~~~~
c:/usr/include/ImageMagick-7/MagickCore/magick-config.h:64:3:
warning: #warning "this is an obsolete behavior please fix your
makefile" [-Wcpp]
64 | # warning "this is an obsolete behavior please fix your
makefile"
| ^~~~~~~
c:/usr/include/ImageMagick-7/MagickCore/magick-config.h:86:3:
error: #error "you should set MAGICKCORE_HDRI_ENABLE"
86 | # error "you should set MAGICKCORE_HDRI_ENABLE"
2) I've hacked around this but just setting a #define MAGICKCORE_HDRI_ENABLE in php_imagick_defs.h but no idea if this will cause any issues.
3) An *untested* DLL is at https://smedley.id.au/tmp/imagick-3.8.1-os2-20261028.zip
Cheers,
Paul
Massimo S.
Oct 28, 2026, 6:04:36 AM (12 days ago) Oct 28
to apa...@googlegroups.com
Thanks.
massimo
David McKenna
Oct 28, 2026, 6:54:28 AM (12 days ago) Oct 28
to Apache for OS/2
Paul,
Thanks again for the new Apache build and the imagick.dll! I loaded both and they seem to work well. Only light testing of iMagick but it seems to work and don't get any php errors but if sometrhing crops up I'll let you know.
Re: php 8.3: I loaded an old version last night to try out again (8.3.14) and Wordpress worked fine with it, but neither phpMyAdmin nor Filegator worked (they should work with 8.3). On opening the phpMyAdmin page I get: Internal error: Random\RandomException: Cannot 'open /dev/urandom: No such file or directory'. Filegator just returns a 'error 500: Internal server error. So something with random number generation?
Regards,
Reply all
Reply to author
Forward
0 new messages