PHP 7.3.0, 7.2.13, 7.1.25, 7.0.33, 5.6.39 Released

PHP folks have been busy as there's a lot of PHP security and bug fixes related releases today for PHP versions, 7.2.13, 7.1.25, 7.0.33, 5.6.39 and new major PHP 7.3.0 release. Please read carefully the details below for Centmin Mod compatibility and how to use centmin.sh menu option 5 to upgrade or downgrade PHP versions. For questions and discussions regarding these PHP versions, check out the dedicated discussion thread here.

PHP Releases

• PHP 7.3.0 - latest newest PHP major branch with best performance. Centmin Mod tests at PHP 7.3 vs 7.2 vs 7.1 vs 7.0 (PHP-FPM) Benchmarks. Centmin Mod 123.09beta01 and newer supported only.
  • PHP 7.3 Bug Tracker
  • PHP 7.2 PECL Extension Status
  • What’s New in PHP 7.3 (RC Now Available at Kinsta)
  • WordPress and PHP 7.3
• PHP 7.2.13 - latest fully supported maintenance + security updates in PHP 7.2 branch. Centmin Mod 123.09beta01 and newer supported only.
• PHP 7.1.25 - last maintenance release in PHP 7.1 branch, only security updates until December 2019. Centmin Mod 123.09beta01 and newer supported only. Centmin Mod 123.08stable may work but not all PHP extension routines may work so your mileage may vary.
• PHP 7.0.33 - last security update release as there will be no more updates for PHP 7.0 branch. Centmin Mod 123.08stable max supported version while 123.09beta01 and newer supported as well.
• PHP 5.6.39 - last security update release as there will be no more updates for PHP 5.6 branch. Centmin Mod 123.08stable max supported version while 123.09beta01 and newer supported as well.

Updating PHP On Centmin Mod LEMP Stacks

• For Centmin Mod 123.08stable, first update to latest version code via centmin.sh menu option 23 submenu option 2, exit centmin.sh and re-run centmin.sh menu option 5 to update to PHP 5.6.39 or 7.0.33 version numbers.
• For Centmin Mod 123.09beta01 and newer, first update to latest version code via SSH command = cmupdate (same equivalent to centmin.sh menu option 23 submenu option 2 method). Then run centmin.sh menu option 5 to update to either PHP versions 5.6.39, 7.0.33, 7.1.25, 7.2.13 or if your web apps support it, to PHP 7.3.0. Example output from cmupdate SSH command run:
  
  Code (Text):

  cmupdate
  Saved working directory and index state WIP on 123.09beta01: 5757b40 hide nginx latests stable version listing
  HEAD is now at 5757b40 hide nginx latests stable version listing
  remote: Enumerating objects: 22, done.
  remote: Counting objects: 100% (22/22), done.
  remote: Compressing objects: 100% (1/1), done.
  remote: Total 8 (delta 6), reused 8 (delta 6), pack-reused 0
  Unpacking objects: 100% (8/8), done.
  From https://github.com/centminmod/centminmod
     5757b40..9efe550  123.09beta01 -> origin/123.09beta01
  Updating 5757b40..9efe550
  Fast-forward
   centmin.sh                | 4 ++--
   example/custom_config.inc | 2 +-
   inc/php_upgrade.inc       | 6 +++---
   inc/phpng_download.inc    | 6 +++---
   4 files changed, 9 insertions(+), 9 deletions(-)
  

• If you're on Centmin Mod 123.08stable and want PHP 7.1, 7.2, or 7.3 support, you will need to update your server from Centmin Mod 123.08stable to 123.09beta01 first. This can be done via centmin.sh menu option 23 submenu option 3 to switch Centmin Mod branches as outlined in 1st post under heading of How to switch to 123.09beta01 branch ? at Centmin Mod .09 beta branch Testing as well as official update page.
  Code (Text):

  --------------------------------------------------------
         Centmin Mod Updater Sub-Menu           
  --------------------------------------------------------
  1). Setup Centmin Mod Github Environment
  2). Update Centmin Mod Current Branch
  3). Update Centmin Mod Newer Branch
  4). Exit
  --------------------------------------------------------
  Enter option [ 1 - 4 ] 3
  --------------------------------------------------------
  

• If you are on Centmin Mod 123.08stable and concerned about losing customisations when you upgrade to Centmin Mod 123.09beta01, read this guide on how to upgrade and keep most of your customisations at How to upgrade Centmin Mod + backing up customisations.

Centmin Mod 123.09beta01 PHP 7.3.0 GA stable update

Code (Text):

--------------------------------------------------------
     Centmin Mod Menu 123.09beta01 centminmod.com
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  XCache Re-install
7).  APC Cache Re-install
8).  XCache Install
9).  APC Cache Install
10). Memcached Server Re-install
11). MariaDB MySQL Upgrade & Management
12). Zend OpCache Install/Re-install
13). Install/Reinstall Redis PHP Extension
14). SELinux disable
15). Install/Reinstall ImagicK PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: pigz,pbzip2,lbzip2...
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Install/Re-Install
21). Update - Nginx + PHP-FPM + Siege
22). Add Wordpress Nginx vhost + Cache Plugin
23). Update Centmin Mod Code Base
24). Exit
--------------------------------------------------------
Enter option [ 1 - 24 ] 5
--------------------------------------------------------

Code (Text):

Do you want to run YUM install checks ?  [y/n]

This will increase your upgrade duration time wise.
Check the change log centminmod.com/changelog.html
to see if any Nginx or PHP related new additions
which require checking YUM prequisites are met.
If no new additions made, you can skip the
YUM install check to speed up upgrade time.

 [y/n]: n

Code (Text):

----------------------------------------------------------------
Install which version of PHP? (version i.e. 5.6.38, 7.0.33, NGDEBUG)
PHP 7.x/7.1.x/7.2.x/7.3.x is GA Stable but still may have broken PHP extensions.
NGDEBUG is PHP 7.4.0 dev builds minus incompatible PHP extensions
----------------------------------------------------------------
Enter PHP Version number you want to upgrade/downgrade to: 7.3.0
----------------------------------------------------------------
existing php.ini will be backed up at /usr/local/lib/php.ini-oldversion_051218-175225
----------------------------------------------------------------

Code (Text):

-----------------------------------------------------------------------------------------
Detected PHP 7.3 branch.
You can compile Zend OPcache (Zend Optimizer Plus+) support
as an alternative to using APC Cache or Xcache cache.
But Zend OPcache only provides PHP opcode cache and
DOESN'T do data caching, so if your web apps such as Wordpress,
Drupal or vBulletin require data caching to APC or Xcache,
it won't work with Zend OPcache.

-----------------------------------------------------------------------------------------
Do you want to use Zend OPcache [y/n] ? y

*************************************************
* Zend Optimizer Plus OPcache configured
*************************************************

PHP 7+ detected which uses newer mysqlnd
or PDO MySQL extensions and removed the
legacy mysql extension. You can optionally
re-add the removed legacy mysql extension
to PHP 7+ by answering yes to next question
Only answer yes if you know for sure you
have very old web scripts which need mysql
legacy extension re-added. Otherwise answer
no which is recommended for best stability

Re-add legacy mysql extension to PHP 7+ [y/n] ? n

Code (Text):

php -v
PHP 7.3.0 (cli) (built: Dec  5 2018 17:54:56) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.0-dev, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.3.0, Copyright (c) 1999-2018, by Zend Technologies

PHP 7.3.0 with Argon2 hash algorithm support and libsodium PHP extension

Code (Text):

php -r 'print_r(get_defined_constants());' | grep -i argon
    [PASSWORD_ARGON2I] => 2
    [PASSWORD_ARGON2ID] => 3
    [PASSWORD_ARGON2_DEFAULT_MEMORY_COST] => 1024
    [PASSWORD_ARGON2_DEFAULT_TIME_COST] => 2
    [PASSWORD_ARGON2_DEFAULT_THREADS] => 2
    [SODIUM_CRYPTO_PWHASH_ALG_ARGON2I13] => 1
    [SODIUM_CRYPTO_PWHASH_ALG_ARGON2ID13] => 2
    [SODIUM_CRYPTO_PWHASH_STRPREFIX] => $argon2id$

Code (Text):

php --ri sodium

sodium

sodium support => enabled
libsodium headers version => 1.0.16
libsodium library version => 1.0.16

Troubleshooting PHP Upgrades

Most common issue between major PHP branch upgrades like PHP 7.1 to 7.2 or PHP 7.2 to 7.3 is having to recompile some PHP extensions which may not be compatible between major PHP versions. Usually, you will encounter PHP Startup/Warning errors mentioning Unable to load dynamic library and then name the PHP extension that isn't working. Example for memcached and redis PHP extensions, memcached.so and redis.so respectively.

Code (Text):

PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/local/lib/php/extensions/no-debug-zts-20180731/memcached.so' (tried: /usr/local/lib/php/extensions/no-debug-zts-20180731/memcached.so (/usr/local/lib/php/extensions/no-debug-zts-20180731/memcached.so: undefined symbol: executor_globals_id), /usr/local/lib/php/extensions/no-debug-non-zts-20180731//usr/local/lib/php/extensions/no-debug-zts-20180731/memcached.so.so (/usr/local/lib/php/extensions/no-debug-non-zts-20180731//usr/local/lib/php/extensions/no-debug-zts-20180731/memcached.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0

PHP Warning:  PHP Startup: Unable to load dynamic library 'redis.so' (tried: /usr/local/lib/php/extensions/no-debug-non-zts-20180731/redis.so (/usr/local/lib/php/extensions/no-debug-non-zts-20180731/redis.so: cannot open shared object file: No such file or directory), /usr/local/lib/php/extensions/no-debug-non-zts-20180731/redis.so.so (/usr/local/lib/php/extensions/no-debug-non-zts-20180731/redis.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0

For 123.09beta01 branch, just re-run centmin.sh menu option 10 to reinstall memcached PHP extension and centmin.sh menu option 13 submenu option 2 to reinstall redis PHP extension.

Code (Text):

--------------------------------------------------------
     Centmin Mod Menu 123.09beta01 centminmod.com
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  XCache Re-install
7).  APC Cache Re-install
8).  XCache Install
9).  APC Cache Install
10). Memcached Server Re-install
11). MariaDB MySQL Upgrade & Management
12). Zend OpCache Install/Re-install
13). Install/Reinstall Redis PHP Extension
14). SELinux disable
15). Install/Reinstall ImagicK PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: pigz,pbzip2,lbzip2...
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Install/Re-Install
21). Update - Nginx + PHP-FPM + Siege
22). Add Wordpress Nginx vhost + Cache Plugin
23). Update Centmin Mod Code Base
24). Exit
--------------------------------------------------------
Enter option [ 1 - 24 ] 10
--------------------------------------------------------

checking to see if memcached PHP extension is now loaded

Code (Text):

php --ri memcached

memcached

memcached support => enabled
Version => 3.1.0-dev
libmemcached version => 1.0.16
SASL support => yes
Session support => yes
igbinary support => no
json support => yes
msgpack support => no

Directive => Local Value => Master Value
memcached.sess_locking => On => On
memcached.sess_lock_wait_min => 150 => 150
memcached.sess_lock_wait_max => 150 => 150
memcached.sess_lock_retries => 5 => 5
memcached.sess_lock_expire => 0 => 0
memcached.sess_binary_protocol => Off => Off
memcached.sess_consistent_hash => Off => Off
memcached.sess_consistent_hash_type => ketama => ketama
memcached.sess_number_of_replicas => 0 => 0
memcached.sess_randomize_replica_read => Off => Off
memcached.sess_remove_failed_servers => Off => Off
memcached.sess_server_failure_limit => 0 => 0
memcached.sess_connect_timeout => 3000 => 3000
memcached.sess_sasl_username => no value => no value
memcached.sess_sasl_password => no value => no value
memcached.sess_persistent => Off => Off
memcached.sess_prefix => memc.sess.key. => memc.sess.key.
memcached.sess_lock_wait => not set => not set
memcached.sess_lock_max_wait => not set => not set
memcached.compression_type => fastlz => fastlz
memcached.compression_factor => 1.3 => 1.3
memcached.compression_threshold => 2000 => 2000
memcached.serializer => php => php
memcached.store_retry_count => 2 => 2
memcached.default_consistent_hash => Off => Off
memcached.default_binary_protocol => Off => Off
memcached.default_connect_timeout => 0 => 0

Code (Text):

--------------------------------------------------------
         Redis PHP Extension Sub-Menu
--------------------------------------------------------
1). Install Redis PHP Extension
2). Reinstall Redis PHP Extension
3). Back to Main menu
--------------------------------------------------------
Enter option [ 1 - 3 ] 2

Checking to see if redis PHP extension is now loaded

Code (Text):

php --ri redis

redis

Redis Support => enabled
Redis Version => 4.2.0
Available serializers => php, igbinary

Directive => Local Value => Master Value
redis.arrays.autorehash => 0 => 0
redis.arrays.connecttimeout => 0 => 0
redis.arrays.distributor => no value => no value
redis.arrays.functions => no value => no value
redis.arrays.hosts => no value => no value
redis.arrays.index => 0 => 0
redis.arrays.lazyconnect => 0 => 0
redis.arrays.names => no value => no value
redis.arrays.pconnect => 0 => 0
redis.arrays.previous => no value => no value
redis.arrays.readtimeout => 0 => 0
redis.arrays.retryinterval => 0 => 0
redis.clusters.persistent => 0 => 0
redis.clusters.read_timeout => 0 => 0
redis.clusters.seeds => no value => no value
redis.clusters.timeout => 0 => 0
redis.session.locking_enabled => 0 => 0
redis.session.lock_expire => 0 => 0
redis.session.lock_retries => 10 => 10
redis.session.lock_wait_time => 2000 => 2000

PHP 7.3.0 doesn't support memcache PHP extension, only memcached PHP extension so you will encounter - As at Dec 21, 2018, memcache PHP extension now supports PHP 7.3.0 as I backported a patch so no longer need to remove memcache.ini

Code (Text):

PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/local/lib/php/extensions/no-debug-non-zts-20180731/memcache.so' (tried: /usr/local/lib/php/extensions/no-debug-non-zts-20180731/memcache.so (/usr/local/lib/php/extensions/no-debug-non-zts-20180731/memcache.so: cannot open shared object file: No such file or directory), /usr/local/lib/php/extensions/no-debug-non-zts-20180731//usr/local/lib/php/extensions/no-debug-non-zts-20180731/memcache.so.so (/usr/local/lib/php/extensions/no-debug-non-zts-20180731//usr/local/lib/php/extensions/no-debug-non-zts-20180731/memcache.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0

To fix, just remove memcache.ini located at /etc/centminmod/php.d/memcache.ini

Code (Text):

cd /etc/centminmod/php.d/
rm -rf /etc/centminmod/php.d/memcache.ini
fpmrestart

mailparse PHP extension error

Code (Text):

Starting php-fpm [05-Dec-2018 18:06:21] NOTICE: PHP message: PHP Warning:  PHP Startup: Unable to load dynamic library 'mailparse.so' (tried: /usr/local/lib/php/extensions/no-debug-non-zts-20180731/mailparse.so (/usr/local/lib/php/extensions/no-debug-non-zts-20180731/mailparse.so: cannot open shared object file: No such file or directory), /usr/local/lib/php/extensions/no-debug-non-zts-20180731/mailparse.so.so (/usr/local/lib/php/extensions/no-debug-non-zts-20180731/mailparse.so.so: cannot open shared object file: No such file or directory)) in Unknown on line 0
 done

To fix, just remove mailparse.ini located at /etc/centminmod/php.d/mailparse.ini

Code (Text):

cd /etc/centminmod/php.d/
rm -rf /etc/centminmod/php.d/mailparse.ini
fpmrestart

Then usually, if you re-run centmin.sh menu option 5, mailparse is reinstalled again. If you still get an error unable to load mailparse.so, then it could be that the specific PHP version hasn't got mailparse PHP extension support yet.

On centmin.sh menu option 5 recompile, mailparse PHP extension is now loaded

Code (Text):

php --ri mailparse

mailparse

mailparse support => enabled
Extension Version => 3.0.3-dev
Revision => $Revision$

Directive => Local Value => Master Value
mailparse.def_charset => us-ascii => us-ascii

You can see a list of custom Centmin Mod installed PHP extensions' ini settings files via command, php --ini

Code (Text):

php --ini
Configuration File (php.ini) Path: /usr/local/lib
Loaded Configuration File:         /usr/local/lib/php-cli.ini
Scan for additional .ini files in: /etc/centminmod/php.d
Additional .ini files parsed:      /etc/centminmod/php.d/a_customphp.ini,
/etc/centminmod/php.d/curlcainfo.ini,
/etc/centminmod/php.d/geoip.ini,
/etc/centminmod/php.d/igbinary.ini,
/etc/centminmod/php.d/imagick.ini,
/etc/centminmod/php.d/mailparse.ini,
/etc/centminmod/php.d/mcrypt.ini,
/etc/centminmod/php.d/memcache.ini,
/etc/centminmod/php.d/memcached.ini,
/etc/centminmod/php.d/redis.ini,
/etc/centminmod/php.d/zendopcache.ini

And list of all PHP extensions loaded

Code (Text):

php -m

output

Code (Text):

php -m
[PHP Modules]
bcmath
bz2
calendar
Core
ctype
curl
date
dom
enchant
exif
fileinfo
filter
ftp
gd
geoip
gettext
gmp
hash
iconv
igbinary
imagick
imap
intl
json
ldap
libxml
mailparse
mbstring
mcrypt
memcached
mysqli
mysqlnd
openssl
pcntl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
posix
pspell
readline
redis
Reflection
session
shmop
SimpleXML
snmp
soap
sockets
sodium
SPL
sqlite3
standard
sysvmsg
sysvsem
sysvshm
tidy
tokenizer
xml
xmlreader
xmlrpc
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache

PHP 7.3 vs 7.2 vs 7.1 vs 7.0 Benchmarks

I've posted early benchmarks for PHP 7.3 vs 7.2 vs 7.1 vs 7.0 (PHP-FPM) with PHP 7.3.0RC6. Also did quick re-test for PHP 7.3.0 GA with PGO tuned + WP PGO trained optimisations enabled to compare here.

System:

• OVH MC-32 Intel Core i7 4790K
• 32GB Memory
• 2x240GB SSD
• 250Mbit Network Bandwidth
• CentOS 7.5 64bit
• Centmin Mod 123.09beta01 LEMP stack - Nginx 1.15.6, MariaDB 10.1.33 MySQL, + CSF Firewall
• BHS, Canada

---

 

PHP 7.3.0 Change Log

Code (Text):

06 Dec 2018, PHP 7.3.0

- Core:
  . Improved PHP GC. (Dmitry, Nikita)
  . Redesigned the old ext_skel program written in PHP, run:
    'php ext_skel.php' for all options. This means there are no dependencies,
    thus making it work on Windows out of the box. (Kalle)
  . Removed support for BeOS. (Kalle)
  . Add PHP_VERSION to phpinfo() <title/>. (github/MattJeevas)
  . Add net_get_interfaces(). (Sara, Joe, Anatol)
  . Implemented flexible heredoc and nowdoc syntax, per
    RFC https://wiki.php.net/rfc/flexible_heredoc_nowdoc_syntaxes.
    (Thomas Punt)
  . Added support for references in list() and array destructuring, per
    RFC https://wiki.php.net/rfc/list_reference_assignment.
    (David Walker)
  . Improved effectiveness of ZEND_SECURE_ZERO for NetBSD and systems
    without native similar feature (devnexen).
  . Added syslog.facility and syslog.ident INI entries for customizing syslog
    logging. (Philip Prindeville)
  . Fixed bug #75683 (Memory leak in zend_register_functions() in ZTS mode).
    (Dmitry)
  . Fixed bug #75031 (support append mode in temp/memory streams). (adsr)
  . Fixed bug #74860 (Uncaught exceptions not being formatted properly when
    error_log set to "syslog"). (Philip Prindeville)
  . Fixed bug #75220 (Segfault when calling is_callable on parent).
    (andrewnester)
  . Fixed bug #69954 (broken links and unused config items in distributed ini
    files). (petk)
  . Fixed bug #74922 (Composed class has fatal error with duplicate, equal const
    properties). (pmmaga)
  . Fixed bug #63911 (identical trait methods raise errors during composition).
    (pmmaga)
  . Fixed bug #75677 (Clang ignores fastcall calling convention on variadic
    function). (Li-Wen Hsu)
  . Fixed bug #54043 (Remove inconsitency of internal exceptions and user
    defined exceptions). (Nikita)
  . Fixed bug #53033 (Mathematical operations convert objects to integers).
    (Nikita)
  . Fixed bug #73108 (Internal class cast handler uses integer instead of
    float). (Nikita)
  . Fixed bug #75765 (Fatal error instead of Error exception when base class is
    not found). (Timur Ibragimov)
  . Fixed bug #76198 (Wording: "iterable" is not a scalar type). (Levi Morrison)
  . Fixed bug #76137 (config.guess/config.sub do not recognize RISC-V). (cmb)
  . Fixed bug #76427 (Segfault in zend_objects_store_put). (Laruence)
  . Fixed bug #76422 (ftruncate fails on files > 2GB). (Anatol)
  . Fixed bug #76509 (Inherited static properties can be desynchronized from
    their parent by ref). (Nikita)
  . Fixed bug #76439 (Changed behaviour in unclosed HereDoc). (Nikita, tpunt)
  . Fixed bug #63217 (Constant numeric strings become integers when used as
    ArrayAccess offset). (Rudi Theunissen, Dmitry)
  . Fixed bug #33502 (Some nullary functions don't check the number of
    arguments). (cmb)
  . Fixed bug #76392 (Error relocating sapi/cli/php: unsupported relocation
    type 37). (Peter Kokot)
  . The declaration and use of case-insensitive constants has been deprecated.
    (Nikita)
  . Added syslog.filter INI entry for syslog filtering. (Philip Prindeville)
  . Fixed bug #76667 (Segfault with divide-assign op and __get + __set).
    (Laruence)
  . Fixed bug #76030 (RE2C_FLAGS rarely honoured) (Cristian Rodríguez)
  . Fixed broken zend_read_static_property (Laruence)
  . Fixed #76773 (Traits used on the parent are ignored for child classes).
    (daverandom)
  . Fixed #76767 (‘asm’ operand has impossible constraints in zend_operators.h).
    (ondrej)
  . Fixed bug #76752 (Crash in ZEND_COALESCE_SPEC_TMP_HANDLER - assertion in
    _get_zval_ptr_tmp failed). (Laruence)
  . Fixed bug #76820 (Z_COPYABLE invalid definition). (mvdwerve, cmb)
  . Fixed bug #76510 (file_exists() stopped working for phar://). (cmb)
  . Fixed bug #76869 (Incorrect bypassing protected method accessibilty check).
    (Dmitry)
  . Fixed bug #72635 (Undefined class used by class constant in constexpr
    generates fatal error). (Nikita)
  . Fixed bug #76947 (file_put_contents() blocks the directory of the file
    (__DIR__)). (Anatol)
  . Fixed bug #76979 (define() error message does not mention resources as
    valid values). (Michael Moravec)
  . Fixed bug #76825 (Undefined symbols ___cpuid_count). (Laruence, cmb)
  . Fixed bug #77110 (undefined symbol zend_string_equal_val in C++ build).
    (Remi)
  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode 
    filter). (Stas)

- BCMath:
  . Implemented request #67855 (No way to get current scale in use). (Chris
    Wright, cmb)
  . Fixed bug #66364 (BCMath bcmul ignores scale parameter). (cmb)
  . Fixed bug #75164 (split_bc_num() is pointless). (cmb)
  . Fixed bug #75169 (BCMath errors/warnings bypass PHP's error handling). (cmb)

- CLI:
  . Fixed bug #44217 (Output after stdout/stderr closed cause immediate exit
    with status 0). (Robert Lu)
  . Fixed bug #77111 (php-win.exe corrupts unicode symbols from cli
    parameters). (Anatol)

- cURL:
  . Expose curl constants from curl 7.50 to 7.61. (Pierrick)
  . Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).
    (cebe)

- Date:
  . Implemented FR #74668: Add DateTime::createFromImmutable() method.
    (majkl578, Rican7)
  . Fixed bug #75222 (DateInterval microseconds property always 0). (jhdxr)
  . Fixed bug #68406 (calling var_dump on a DateTimeZone object modifies it).
    (jhdxr)
  . Fixed bug #76131 (mismatch arginfo for date_create). (carusogabriel)
  . Updated timelib to 2018.01RC1 to address several bugs: (Derick)
    . Fixed bug #75577 (DateTime::createFromFormat does not accept 'v' format
      specifier). (Derick)
    . Fixed bug #75642 (Wrap around behaviour for microseconds is not working).
      (Derick)
  . Fixed bug #77097 (DateTime::diff gives wrong diff when the actual diff is
    less than 1 second). (Derick)

- DBA:
  . Fixed bug #75264 (compiler warnings emitted). (petk)

- DOM:
  . Fixed bug #76285 (DOMDocument::formatOutput attribute sometimes ignored).
    (Andrew Nester, Laruence, Anatol)

- Fileinfo:
  . Fixed bug #77095 (slowness regression in 7.2/7.3 (compared to 7.1)).
    (Anatol)

- Filter:
  . Added the 'add_slashes' sanitization mode (FILTER_SANITIZE_ADD_SLASHES).
    (Kalle)

- FPM:
  . Added fpm_get_status function. (Till Backhaus)
  . Fixed bug #62596 (getallheaders() missing with PHP-FPM). (Remi)
  . Fixed bug #69031 (Long messages into stdout/stderr are truncated
    incorrectly) - added new log related FPM configuration options:
    log_limit, log_buffering and decorate_workers_output. (Jakub Zelenka)

- ftp:
  . Fixed bug #77151 (ftp_close(): SSL_read on shutdown). (Remi)

- GD:
  . Added support for WebP in imagecreatefromstring() (Andreas Treichel, cmb).

- GMP:
  . Export internal structures and accessor helpers for GMP object. (Sara)
  . Added gmp_binomial(n, k). (Nikita)
  . Added gmp_lcm(a, b). (Nikita)
  . Added gmp_perfect_power(a). (Nikita)
  . Added gmp_kronecker(a, b). (Nikita)

- iconv:
  . Fixed bug #53891 (iconv_mime_encode() fails to Q-encode UTF-8 string). (cmb)
  . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
    (cmb)

- IMAP:
  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
    mailbox parameter). (Stas)
  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)

- Interbase:
  . Fixed bug #75453 (Incorrect reflection for ibase_[p]connect). (villfa)
  . Fixed bug #76443 (php+php_interbase.dll crash on module_shutdown). (Kalle)


- intl:
  . Fixed bug #75317 (UConverter::setDestinationEncoding changes source instead
    of destination). (andrewnester)
  . Fixed bug #76829 (Incorrect validation of domain on idn_to_utf8()
    function). (Anatol)

- JSON:
  . Added JSON_THROW_ON_ERROR flag. (Andrea)

- LDAP:
  . Added ldap_exop_refresh helper for EXOP REFRESH operation with dds overlay.
    (Come)
  . Added full support for sending and parsing ldap controls (Come)
  . Fixed bug #49876 (Fix LDAP path lookup on 64-bit distros). (dzuelke)

- libxml2:
  . Fixed bug #75871 (use pkg-config where available). (pmmaga)

- litespeed:
  . Fixed bug #75248 (Binary directory doesn't get created when building
    only litespeed SAPI). (petk)
  . Fixed bug #75251 (Missing program prefix and suffix). (petk)

- MBstring:
  . Updated to Oniguruma 6.9.0. (cmb)
  . Fixed bug #65544 (mb title case conversion-first word in quotation isn't
    capitalized). (Nikita)
  . Fixed bug #71298 (MB_CASE_TITLE misbehaves with curled apostrophe/quote.
    (Nikita)
  . Fixed bug #73528 (Crash in zif_mb_send_mail). (Nikita)
  . Fixed bug #74929 (mbstring functions version 7.1.1 are slow compared to 5.3
    on Windows). (Nikita)
  . Fixed bug #76319 (mb_strtolower with invalid UTF-8 causes segmentation
    fault). (Nikita)
  . Fixed bug #76574 (use of undeclared identifiers INT_MAX and LONG_MAX). (cmb)
  . Fixed bug #76594 (Bus Error due to unaligned access in zend_ini.c
    OnUpdateLong). (cmb, Nikita)
  . Fixed bug #76706 (mbstring.http_output_conv_mimetypes is ignored). (cmb)
  . Fixed bug #76958 (Broken UTF7-IMAP conversion). (Nikita)
  . Fixed bug #77025 (mb_strpos throws Unknown encoding or conversion error).
    (Nikita)
  . Fixed bug #77165 (mb_check_encoding crashes when argument given an empty
    array). (Nikita)

- Mysqlnd:
  . Fixed bug #76386 (Prepared Statement formatter truncates fractional seconds
    from date/time column). (Victor Csiky)

- ODBC:
  . Removed support for ODBCRouter. (Kalle)
  . Removed support for Birdstep. (Kalle)
  . Fixed bug #77079 (odbc_fetch_object has incorrect type signature).
    (Jon Allen)

- Opcache:
  . Fixed bug #76466 (Loop variable confusion). (Dmitry, Laruence, Nikita)
  . Fixed bug #76463 (var has array key type but not value type). (Laruence)
  . Fixed bug #76446 (zend_variables.c:73: zend_string_destroy: Assertion
    `!(zval_gc_flags((str)->gc)). (Nikita, Laruence)
  . Fixed bug #76711 (OPcache enabled triggers false-positive "Illegal string
    offset"). (Dmitry)
  . Fixed bug #77058 (Type inference in opcache causes side effects). (Nikita)
  . Fixed bug #77092 (array_diff_key() - segmentation fault). (Nikita)

- OpenSSL:
  . Added openssl_pkey_derive function. (Jim Zubov)
  . Add min_proto_version and max_proto_version ssl stream options as well as
    related constants for possible TLS protocol values. (Jakub Zelenka)

- PCRE:
  . Implemented https://wiki.php.net/rfc/pcre2-migration (Anatol, Dmitry)
  . Upgrade PCRE2 to 10.32. (Anatol)
  . Fixed bug #75355 (preg_quote() does not quote # control character).
    (Michael Moravec)
  . Fixed bug #76512 (\w no longer includes unicode characters). (cmb)
  . Fixed bug #76514 (Regression in preg_match makes it fail with
    PREG_JIT_STACKLIMIT_ERROR). (Anatol)
  . Fixed bug #76909 (preg_match difference between 7.3 and < 7.3). (Anatol)

- PDO_DBlib:
  . Implemented request #69592 (allow 0-column rowsets to be skipped
    automatically). (fandrieu)
  . Expose TDS version as \PDO::DBLIB_ATTR_TDS_VERSION attribute on \PDO
    instance. (fandrieu)
  . Treat DATETIME2 columns like DATETIME. (fandrieu)
  . Fixed bug #74243 (allow locales.conf to drive datetime format). (fandrieu)

- PDO_Firebird:
  . Fixed bug #74462 (PDO_Firebird returns only NULLs for results with boolean
    for FIREBIRD >= 3.0). (Dorin Marcoci)

- PDO_OCI:
  . Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized
    before PHP-FPM sets it up). (Ingmar Runge)

- PDO SQLite
  . Add support for additional open flags

- pgsql:
  . Added new error constants for pg_result_error(): (Kalle)
    . Requires Postgres 9.3
      . PGSQL_DIAG_SCHEMA_NAME
      . PGSQL_DIAG_TABLE_NAME
      . PGSQL_DIAG_COLUMN_NAME
      . PGSQL_DIAG_DATATYPE_NAME
      . PGSQL_DIAG_CONSTRAINT_NAME
    . Requires Postgres 9.6
      . PGSQL_DIAG_SEVERITY_NONLOCALIZED
  . Fixed bug #77047 (pg_convert has a broken regex for the 'TIME WITHOUT
    TIMEZONE' data type). (Andy Gajetzki)

- phar:
  . Fixed bug #74991 (include_path has a 4096 char limit in some cases).
    (bwbroersma)
  . Fixed bug #65414 (deal with leading slash when adding files correctly).
    (bishopb)
  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
    (Stas)

- readline:
  . Added completion_append_character and completion_suppress_append options
    to readline_info() if linked against libreadline. (krageon)

- Session:
  . Fixed bug #74941 (session fails to start after having headers sent).
    (morozov)

- SimpleXML:
  . Fixed bug #54973 (SimpleXML casts integers wrong). (Nikita)
  . Fixed bug #76712 (Assignment of empty string creates extraneous text node).
    (cmb)

- Sockets:
  . Fixed bug #67619 (Validate length on socket_write). (thiagooak)

- SOAP:
  . Fixed bug #75464 (Wrong reflection on SoapClient::__setSoapHeaders).
    (villfa)
  . Fixed bug #70469 (SoapClient generates E_ERROR even if exceptions=1 is
    used). (Anton Artamonov)
  . Fixed bug #50675 (SoapClient can't handle object references correctly).
    (Cameron Porter)
  . Fixed bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault). (cmb)
  . Fixed bug #77141 (Signedness issue in SOAP when precision=-1). (cmb)

- SPL:
  . Fixed bug #74977 (Appending AppendIterator leads to segfault).
    (Andrew Nester)
  . Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach
    loop). (jhdxr)
  . Fixed bug #74372 (autoloading file with syntax error uses next autoloader,
    may hide parse error). (Nikita)
  . Fixed bug #75878 (RecursiveTreeIterator::setPostfix has wrong signature).
    (cmb)
  . Fixed bug #74519 (strange behavior of AppendIterator). (jhdxr)
  . Fixed bug #76131 (mismatch arginfo for splarray constructor).
    (carusogabriel)

- SQLite3:
  . Updated bundled libsqlite to 3.24.0. (cmb)

- Standard:
  . Added is_countable() function. (Gabriel Caruso)
  . Added support for the SameSite cookie directive, including an alternative
    signature for setcookie(), setrawcookie() and session_set_cookie_params().
    (Frederik Bosch, pmmaga)
  . Remove superfluous warnings from inet_ntop()/inet_pton(). (daverandom)
  . Fixed bug #75916 (DNS_CAA record results contain garbage). (Mike,
    Philip Sharp)
  . Fixed unserialize(), to disable creation of unsupported data structures
    through manually crafted strings. (Dmitry)
  . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator
    that getrandom() is missing). (sarciszewski)
  . Fixed bug #74719 (fopen() should accept NULL as context). (Alexander Holman)
  . Fixed bug #69948 (path/domain are not sanitized in setcookie). (cmb)
  . Fixed bug #75996 (incorrect url in header for mt_rand). (tatarbj)
  . Added hrtime() function, to get high resolution time. (welting)
  . Fixed bug #48016 (stdClass::__setState is not defined although var_export()
    uses it). (Andrea)
  . Fixed bug #76136 (stream_socket_get_name should enclose IPv6 in brackets).
    (seliver)
  . Fixed bug #76688 (Disallow excessive parameters after options array).
    (pmmaga)
  . Fixed bug #76713 (Segmentation fault caused by property corruption).
    (Laruence)
  . Fixed bug #76755 (setcookie does not accept "double" type for expire time).
    (Laruence)
  . Fixed bug #76674 (improve array_* failure messages exposing what was passed
    instead of an array). (carusogabriel)
  . Fixed bug #76803 (ftruncate changes file pointer). (Anatol)
  . Fixed bug #76818 (Memory corruption and segfault). (Remi)
  . Fixed bug #77081 (ftruncate() changes seek pointer in c mode). (cmb, Anatol)

- Testing:
  . Implemented request #62055 (Make run-tests.php support --CGI-- sections).
    (cmb)

- Tidy:
  . Support using tidyp instead of tidy (devnexen).
  . Fixed bug #74707 (Tidy has incorrect ReflectionFunction param counts for
    functions taking tidy). (Gabriel Caruso)
  . Fixed arginfo for tidy::__construct(). (Tyson Andre)

- Tokenizer:
  . Fixed bug #76437 (token_get_all with TOKEN_PARSE flag fails to recognise
    close tag). (Laruence)
  . Fixed bug #75218 (Change remaining uncatchable fatal errors for parsing
    into ParseError). (Nikita)
  . Fixed bug #76538 (token_get_all with TOKEN_PARSE flag fails to recognise
    close tag with newline). (Nikita)
  . Fixed bug #76991 (Incorrect tokenization of multiple invalid flexible
    heredoc strings). (Nikita)

- XML:
  . Fixed bug 71592 (External entity processing never fails). (cmb)

- Zlib:
  . Added zlib/level context option for compress.zlib wrapper. (Sara)

 

PHP 7.2.13 Change Log

Code (Text):

06 Dec 2018, PHP 7.2.13

- ftp:
  . Fixed bug #77151 (ftp_close(): SSL_read on shutdown). (Remi)

- CLI:
  . Fixed bug #77111 (php-win.exe corrupts unicode symbols from cli
    parameters). (Anatol)

- Fileinfo:
  . Fixed bug #77095 (slowness regression in 7.2/7.3 (compared to 7.1)).
    (Anatol)

- iconv:
  . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
    (cmb)

- Core:
  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode
    filter). (Stas)

- IMAP:
  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
    mailbox parameter). (Stas)

- ODBC:
  . Fixed bug #77079 (odbc_fetch_object has incorrect type signature).
    (Jon Allen)

- Opcache:
  . Fixed bug #77058 (Type inference in opcache causes side effects). (Nikita)
  . Fixed bug #77092 (array_diff_key() - segmentation fault). (Nikita)

- Phar:
  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
    (Stas)

- PGSQL:
  . Fixed bug #77047 (pg_convert has a broken regex for the 'TIME WITHOUT
    TIMEZONE' data type). (Andy Gajetzki)

- SOAP:
  . Fixed bug #50675 (SoapClient can't handle object references correctly).
    (Cameron Porter)
  . Fixed bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault). (cmb)
  . Fixed bug #77141 (Signedness issue in SOAP when precision=-1). (cmb)

- Sockets:
  . Fixed bug #67619 (Validate length on socket_write). (thiagooak)

 

PHP 7.1.25 Change Log

Code (Text):

06 Dec 2018, PHP 7.1.25

- Core:
  . Fixed bug #71041 (zend_signal_startup() needs ZEND_API).
    (Valentin V. Bartenev)

- ftp:
  . Fixed bug #77151 (ftp_close(): SSL_read on shutdown). (Remi)

- iconv:
  . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
    (cmb)

- Core:
  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode 
    filter). (Stas)

- IMAP:
  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
    mailbox parameter). (Stas)

- ODBC:
  . Fixed bug #77079 (odbc_fetch_object has incorrect type signature).
    (Jon Allen)

- Opcache:
  . Fixed bug #77058 (Type inference in opcache causes side effects). (Nikita)

- Phar:
  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
    (Stas)

- PGSQL:
  . Fixed bug #77047 (pg_convert has a broken regex for the 'TIME WITHOUT
    TIMEZONE' data type). (Andy Gajetzki)

- SOAP:
  . Fixed bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault). (cmb)
  . Fixed bug #77141 (Signedness issue in SOAP when precision=-1). (cmb)

- Sockets:
  . Fixed bug #67619 (Validate length on socket_write). (thiagooak)

 

PHP 7.0.33 Change Log

Code (Text):

06 Dec 2018 PHP 7.0.33

- Core:
  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode
    filter). (Stas)

- IMAP:
  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
    mailbox parameter). (Stas)

- Phar:
  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
    (Stas)

 

PHP 5.6.39 Change Log

Code (Text):

06 Dec 2018, PHP 5.6.39

- Core:
  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode
    filter). (Stas)

- IMAP:
  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
    mailbox parameter). (Stas)

- Phar:
  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
    (Stas)

 

PHP Version Support Timelines

Updated PHP release support timelines from PHP: Supported Versions.

• PHP 7.3.0 active full support until December 6, 2020 and then security only support from December 6, 2020 to December 2021.
• While PHP 7.2 has active full support until November 30, 2019 and security only support until November 30, 2020.
• PHP 5.6 has security support extended till end of December 2018 (end of this month)

 

FYI, seems PHP 7.1.25 and 7.2.13 missed one security CVE-2018-19935 fix for PHP IMAP mail PHP :: Sec Bug #77020 :: null pointer dereference in imap_mail

from CVE - CVE-2018-19935

I just updated Centmin Mod 123.09beta01 on December 9, 2018 to auto patch PHP 7.1.25 and 7.2.13 with the missing CVE security bug fix Beta Branch - auto patch PHP 7.1.25 & 7.2.13 for missing security CVE-2018-19935 fix.

Be sure to updated 123.09beta01 via cmupdate command before re-running centmin.sh menu option 5 to reinstall PHP 7.2.13 or 7.1.25 if those versions are being used.

Code (Text):

cmupdate
Saved working directory and index state WIP on 123.09beta01: c61c197 update centmin.sh menu option 22 in 123.09beta01
HEAD is now at c61c197 update centmin.sh menu option 22 in 123.09beta01
remote: Enumerating objects: 26, done.
remote: Counting objects: 100% (26/26), done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 11 (delta 6), reused 11 (delta 6), pack-reused 0
Unpacking objects: 100% (11/11), done.
From https://github.com/centminmod/centminmod
   c61c197..d00c75c  123.09beta01 -> origin/123.09beta01
Updating c61c197..d00c75c
Fast-forward
 centmin.sh                 |  8 +++++++-
 example/custom_config.inc  |  1 +
 inc/php_patch.inc          | 33 +++++++++++++++++++++++++++++++++
 inc/php_upgrade.inc        | 14 +++-----------
 patches/php/77020fix.patch | 10 ++++++++++
 5 files changed, 54 insertions(+), 12 deletions(-)
 create mode 100644 inc/php_patch.inc
 create mode 100644 patches/php/77020fix.patch

After PHP 7.2.13 or 7.1.25 recompile, you can inspect /root/centminlogs/patch_php_*.log to see if PHP was auto patched i.e.

Code (Text):

cat /root/centminlogs/patch_php_091218-081052.log

patching PHP for CVE-2018-19935
https://bugs.php.net/bug.php?id=77020

/svr-setup/php-7.2.13/ext/imap /svr-setup/php-7.2.13
dos2unix: converting file 77020fix.patch to Unix format ...
patching file php_imap.c

 

Xenforo folks reported that a bug in PHP 7.3.0 Zend Opcache can potentially result in data loss and would be fixed in PHP 7.3.1 so probably need to hold off on PHP 7.3.0 for production usage.

• XenForo 1.5.23 Released
• PHP :: Bug #77275 :: OPcache optimization problem for ArrayAccess->offsetGet(string)

I might end up applying the patch to PHP 7.3.0 for Centmin Mod, will see

Edit: updated Centmin Mod 123.09beta01 code to auto patch fix PHP 7.3.0 for this Zend Opcache bug Beta Branch - auto patch PHP 7.3.0 for serious Zend Opcache bug