BSD PortsPHP -- Multiple vulnerabilities
· CVE-2026-109618, CVE-2026-109619 · VuXML entry
The PHP project reports: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.
Affected versions
- php82 < 8.2.35
- php83 < 8.3.36
- php84 < 8.4.27
- php85 < 8.5.12
- php86 < 8.6.0.r4
By system
7 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | lang/php82 | 8.2.28 | vulnerable since 2026-10-21 | |
| NetBSD | lang/php82 | 8.2.33nb1 | listed since 2026-10-21 | |
| MidnightBSD | lang/php82 | 8.2.35 | out of range, by version | |
| FreeBSD | lang/php82 | 8.2.35_2 | fixed | |
| DragonFly | lang/php83 | 8.3.21 | vulnerable since 2026-10-21 | |
| NetBSD | lang/php83 | 8.3.33nb1 | listed since 2026-10-21 | |
| MidnightBSD | lang/php83 | 8.3.36 | out of range, by version | |
| FreeBSD | lang/php83 | 8.3.36_2 | fixed | |
| DragonFly | lang/php84 | 8.4.8 | vulnerable since 2026-10-21 | |
| NetBSD | lang/php84 | 8.4.25nb1 | listed since 2026-10-21 | |
| MidnightBSD | lang/php84 | 8.4.27 | out of range, by version | |
| FreeBSD | lang/php84 | 8.4.27_2 | fixed | |
| FreeBSD | lang/php85 | 8.5.12_2 | fixed | |
| NetBSD | lang/php85 | 8.5.10nb1 | listed since 2026-10-21 | |
| MidnightBSD | lang/php85 | 8.5.12 | out of range, by version | |
| FreeBSD | lang/php86 | 8.6.0.r4 | fixed | |
| MidnightBSD | lang/php86 | 8.6.0.r3 | in range, by version |