PHP Security PHP 7.3.0, 7.2.13, 7.1.25, 7.0.33, 5.6.39 Discussion Thread

Discussion thread for PHP 7.3.0, 7.2.13, 7.1.25, 7.0.33, 5.6.39 releases.

• PHP 7.3 Bug Tracker
• PHP 7.2 PECL Extension Status
• What’s New in PHP 7.3 (RC Now Available at Kinsta)
• WordPress and PHP 7.3

For PHP 7.3.0 PHP: News Archive - 2018

---

 

New shiny PHP releases are out including PHP 7.3.0 PHP 7.3.0, 7.2.13, 7.1.25, 7.0.33, 5.6.39 Released

 

Yeah i suspect not all php scripts will be PHP 7.3.0 100% ready yet. Xenforo is same with next release having PHP 7.3.0 support sometime next week Duplicate - PHP Warning: "continue" targeting switch is equivalent to "break". Did you mean to use "continue 2"?

Final Wordpress 5.0 stable release is also due out today too with PHP 7.3.0 support WordPress 5.0 RC3

 

It is as of today for 123.09beta01 as per PHP 7.3.0, 7.2.13, 7.1.25, 7.0.33, 5.6.39 Released

Good to hear

 

see WordPress and PHP 7.3

 

Posting my Xenforo debug speed numbers on PHP 7.2.13 PGO before I change to PHP 7.3.0 PGO

• Xenforo 1.5.22 with Centmin Mod 123.09beta01 Nginx 1.15.7 + PHP 7.2.13 PGO (php-fpm)
• Linode 8GB 4CPU KVM VPS - Intel Xeon E5-2680v2 2.8Ghz

Code (Text):

Index - https://community.centminmod.com/

Timing: 0.0463 seconds Memory: 7.101 MB DB Queries: 29
Timing: 0.0475 seconds Memory: 7.102 MB DB Queries: 29
Timing: 0.0471 seconds Memory: 7.102 MB DB Queries: 29

Forum News - https://community.centminmod.com/forums/forum-news.2/

Timing: 0.0480 seconds Memory: 7.268 MB DB Queries: 31
Timing: 0.0481 seconds Memory: 7.268 MB DB Queries: 31
Timing: 0.0472 seconds Memory: 7.266 MB DB Queries: 31

Forum News Thread - https://community.centminmod.com/threads/forums-update-php-7-2-latest.16187/

Timing: 0.0528 seconds Memory: 8.191 MB DB Queries: 30
Timing: 0.0538 seconds Memory: 8.192 MB DB Queries: 30
Timing: 0.0521 seconds Memory: 8.192 MB DB Queries: 30

Members List - https://community.centminmod.com/members/

Timing: 0.0388 seconds Memory: 5.914 MB DB Queries: 18
Timing: 0.0399 seconds Memory: 5.914 MB DB Queries: 18
Timing: 0.0390 seconds Memory: 5.914 MB DB Queries: 18

Conversations Index - https://community.centminmod.com/conversations/

Timing: 0.0287 seconds Memory: 5.530 MB DB Queries: 15
Timing: 0.0276 seconds Memory: 5.530 MB DB Queries: 15
Timing: 0.0286 seconds Memory: 5.530 MB DB Queries: 15

 

FYI, seems PHP 7.1.25 and 7.2.13 missed one security CVE-2018-19935 fix for PHP IMAP mail PHP :: Sec Bug #77020 :: null pointer dereference in imap_mail

from CVE - CVE-2018-19935

I just updated Centmin Mod 123.09beta01 to auto patch PHP 7.1.25 and 7.2.13 with the missing CVE security bug fix Beta Branch - auto patch PHP 7.1.25 & 7.2.13 for missing security CVE-2018-19935 fix.

Be sure to updated 123.09beta01 via cmupdate command before re-running centmin.sh menu option 5 to reinstall PHP 7.2.13 or 7.1.25 if those versions are being used.

Code (Text):

cmupdate
Saved working directory and index state WIP on 123.09beta01: c61c197 update centmin.sh menu option 22 in 123.09beta01
HEAD is now at c61c197 update centmin.sh menu option 22 in 123.09beta01
remote: Enumerating objects: 26, done.
remote: Counting objects: 100% (26/26), done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 11 (delta 6), reused 11 (delta 6), pack-reused 0
Unpacking objects: 100% (11/11), done.
From https://github.com/centminmod/centminmod
   c61c197..d00c75c  123.09beta01 -> origin/123.09beta01
Updating c61c197..d00c75c
Fast-forward
 centmin.sh                 |  8 +++++++-
 example/custom_config.inc  |  1 +
 inc/php_patch.inc          | 33 +++++++++++++++++++++++++++++++++
 inc/php_upgrade.inc        | 14 +++-----------
 patches/php/77020fix.patch | 10 ++++++++++
 5 files changed, 54 insertions(+), 12 deletions(-)
 create mode 100644 inc/php_patch.inc
 create mode 100644 patches/php/77020fix.patch

After PHP 7.2.13 or 7.1.25 recompile, you can inspect /root/centminlogs/patch_php_*.log to see if PHP was auto patched i.e.

Code (Text):

cat /root/centminlogs/patch_php_091218-081052.log

patching PHP for CVE-2018-19935
https://bugs.php.net/bug.php?id=77020

/svr-setup/php-7.2.13/ext/imap /svr-setup/php-7.2.13
dos2unix: converting file 77020fix.patch to Unix format ...
patching file php_imap.c

 

Xenforo folks reported that a bug in PHP 7.3.0 Zend Opcache can potentially result in data loss and would be fixed in PHP 7.3.1 so probably need to hold off on PHP 7.3.0 for production usage.

• XenForo 1.5.23 Released
• PHP :: Bug #77275 :: OPcache optimization problem for ArrayAccess->offsetGet(string)

I might end up applying the patch to PHP 7.3.0 for Centmin Mod, will see

Edit: updated Centmin Mod 123.09beta01 code to auto patch fix PHP 7.3.0 for this Zend Opcache bug Beta Branch - auto patch PHP 7.3.0 for serious Zend Opcache bug