The PHP development team would like to announce the immediate
availability of PHP 5.4.3 and PHP 5.3.13. All users are encouraged
to upgrade to PHP 5.4.3 or PHP 5.3.13
The releases complete a fix for a vulnerability
in CGI-based setups (CVE-2012-2311). Note: mod_php and php-fpm are not vulnerable to this attack.
PHP 5.4.3 fixes a buffer overflow vulnerability in the
apache_request_headers() (CVE-2012-2329).
The PHP 5.3 series is not vulnerable to this issue.
For source downloads of PHP 5.4.3 and PHP 5.3.13 please visit our downloads page,
Windows binaries can be found on windows.php.net/download/.
The list of changes are recorded in the ChangeLog.
PHP 5.3.12/5.4.2 do not fix all variations of the CGI issues described
in CVE-2012-1823. It has also come to our attention that some sites use
an insecure cgiwrapper script to run PHP. These scripts will use $*
instead of "$@" to pass parameters to php-cgi which causes a number of
issues. Again, people using mod_php or php-fpm are not affected.
One way to address these CGI issues is to reject the request if the query string
contains a '-' and no '='. It can be done using Apache's mod_rewrite like this:
Note that this will block otherwise safe requests like ?top-40 so if you
have query parameters that look like that, adjust your regex accordingly.
Another set of releases are planned for Tuesday, May, 8th. These
releases will fix the CGI flaw and another CGI-related issue in
apache_request_header (5.4 only).
We apologize for the inconvenience created with these releases and the
(lack of) communication around them.
There is a vulnerability in certain CGI-based setups (Apache+mod_php and nginx+php-fpm are not affected)
that has gone unnoticed for at least 8 years. Section
7 of the CGI spec states:
Some systems support a method for supplying a [sic] array of strings to the
CGI script. This is only used in the case of an `indexed' query. This
is identified by a "GET" or "HEAD" HTTP request with a URL search
string not containing any unencoded "=" characters.
So, requests that do not have a "=" in the query string are treated
differently from those who do in some CGI implementations. For PHP this
means that a request containing ?-s may dump the PHP source code for the
page, but a request that has ?-s&=1 is fine.
A large number of sites run PHP as either an Apache module through
mod_php or using php-fpm under nginx. Neither of these setups are
vulnerable to this. Straight shebang-style CGI also does not appear to
be vulnerable.
If you are using Apache mod_cgi to run PHP you may be vulnerable. To see
if you are, just add ?-s to the end of any of your URLs. If you see your
source code, you are vulnerable. If your site renders normally, you are not.
To fix this, update to PHP 5.3.12 or PHP 5.4.2.
We recognize that since CGI is a rather outdated way to run PHP, it may not be feasible to
upgrade these sites to a modern version of PHP. An alternative is to
configure your web server to not let these types of requests with query
strings starting with a "-" and not containing a "=" through. Adding a
rule like this should not break any sites. For Apache using mod_rewrite
it would look like this:
If you are writing your own rule, be sure to take the urlencoded ?%2ds
version into account.
Making a bad week worse, we had a bug in our bug system that toggled the
private flag of a bug report to public on a comment to the bug report
causing this issue to go public before we had time to test solutions to
the level we would like. Please report any issues via bugs.php.net.
DevConf is the ultimate meeting place for russian-speaking web-developers,
combining several language-specific conferences under one roof.
This year DevConf will include the following sections:
DevConf::PHP();
DevConf::Perl();
DevConf::RoR();
DevConf::Python();
DevConf::Javascript();
Each section will feature several talks from the active contributors/authors of the language.
Among the invited speakers are Derick Rethans (XDebug creator),
David Soria Parra (active PHP contributor), Andrey Aksyonov (author of Sphinx),
Alexander Makarov (one of the main contributors to Yii),
Sergey Petrunya (of MariaDB fame), Ilya Alekseev (OpenStack Nova contributor)
and many others, see more details on the official website.
The PHP development team announces the immediate availability of PHP 5.3.11 and PHP 5.4.1. These releases focuses on improving the stability of the current PHP branches with over 60 bug fixes, some of which are security related.
Security Enhancements for both PHP 5.3.11 and PHP 5.4.1:
Fixed bug #54374 (Insufficient validating of upload name leading to corrupted $_FILES indices). (CVE-2012-1172).
Add open_basedir checks to readline_write_history and readline_read_history.
Security Enhancement affecting PHP 5.3.11 only:
Fixed bug #61043 (Regression in magic_quotes_gpc fix for CVE-2012-0831).
The PHP development team would like to announce the 2nd
release candidate of PHP 5.4.1.
Windows binaries can be downloaded from the
Windows QA site.
THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!
This is the 2nd release candidate. The release candidate phase is
intended as a period of bug fixing prior to the stable release.
The release candidate fixes a critical issue when using the internal
classes in multiple threads.
A complete list of changes since the last release candidate can be
found in the
NEWS
file.
Please help us to identify
bugs in order to ensure that the release is solid and all things behave
as expected by taking the time to test this release candidate against
your code base and reporting any problems that you encounter to
the QA mailing list and/or
the PHP bug tracker.
The PHP development team is proud to announce the immediate availability of PHP
5.4.0.
This release is a major leap forward in the 5.x series, which includes a
large number of new features and bug fixes.
The PHP development team would like to announce the 8th
release candidate of PHP 5.4.
PHP 5.4 includes new language features and removes several legacy
(deprecated) behaviours. Windows binaries can be downloaded from the
Windows QA site.
THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!
.
This is the 8th release candidate. The release candidate phase is
intended as a period of bug fixing prior to the stable release. No new
features should be included before the final version of PHP 5.4.0.
The 7th and 8th release candidates focus on fixing critical bugs and
security vulnerabilities, including:
A buffer overflow in htmlspecialchars() and htmlentities()
(bug #60965).
Improving the max_input_vars configuration directive to check nested
variables.
A complete list of changes since the last release candidate can be
found in the
NEWS
file.
We've received a lot of feedback that has helped to improve the
upcoming release of PHP 5.4.0. Please continue to help us to identify
bugs in order to ensure that the release is solid and all things behave
as expected by taking the time to test this release candidate against
your code base and reporting any problems that you encounter to
the QA mailing list and/or
the PHP bug tracker.
The next release candidate will be released on
March 1.
Please note: This call for papers closes on 12 April, 2012.
Wanting to share your experiences with a larger PHP community? Please submit your name and topic ideas
(even if you are only suggesting topics and not wishing to actually present them) - each topic requires
a separate submission, submit as many as you like:
The PHP development team announces the 6th
release candidate of PHP 5.4.
PHP 5.4 includes new language features and removes several legacy
(deprecated) behaviours. Windows binaries can be downloaded from the
Windows QA site.
THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!.
This is the 6th release candidate. The release candidate phase is intended as
a period of bug fixing prior to the stable release. No new features should
be included before the final version of PHP 5.4.0.
The 6th release candidate focused on improving traits. Please test
them carefully and help us to identify bugs in
order to ensure that the release is solid and all things behave
as expected. Please take the time to test this release candidate
against your code base and report any problems that you encounter
to the QA mailing list and/or
the PHP bug tracker.
A complete list of changes since the last release candidate can be
found at NEWS
ConFoo 2012 in Montreal, Canada on Feb 29 - Mar 02
ConFoo is the unique web conference in Canada gathering different
tech communities in one place.
find working solutions for your day to day challenges;
discover new tools that increase your productivity;
network with people from some of the world’s biggest companies;
160 presentations focusing on core competencies improvement;
Don't miss this great opportunity and register today!
Also check out our two training days
around PHP, HTML5, Symfony2 and security topics right before the
conference.
The PHP development team would like to announce the immediate
availability of PHP 5.3.9. This release focuses on improving the
stability of the PHP 5.3.x branch with over 90 bug fixes, some of
which are security related.
Security Enhancements and Fixes in PHP 5.3.9:
Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885)
Fixed bug #60150 (Integer overflow during the parsing of invalid exif
header). (CVE-2011-4566)
Key enhancements in PHP 5.3.9 include:
Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd argument to
is_a and is_subclass_of).
The PHP development team announces the 5th
release candidate of PHP 5.4.
PHP 5.4 includes new language features and removes several legacy
(deprecated) behaviours. Windows binaries can be downloaded from the
Windows QA site.
THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!.
This is the 5th release candidate. The release candidate phase is intended as
a period of bug fixing prior to the stable release. No new features should
be included before the final version of PHP 5.4.0.
We got a lot of feedback that helped us to improve the upcoming
PHP version. Please continue to help us to identify bugs in
order to ensure that the release is solid and all things behave
as expected. Please take the time to test this release candidate
against your code base and report any problems that you encounter
to the QA mailing list and/or
the PHP bug tracker.
A complete list of changes since the last release candidate can be
found at NEWS
The next and probably last release candidate will be released in 14 days.
The PHPBenelux Conference is ready for its third edition and takes place
January 27th & 28th in Antwerp (Belgium).
We're very proud to have a great
lineup this year and some awesome social events. All information about the
conference can be found on our conference website
http://conference.phpbenelux.eu/2012.
Ibuildings is proud to organise the sixth Dutch PHP Conference on June 8 and 9, plus a pre-conference tutorial day on June 7. Both programs will be completely in English so the only Dutch thing about it is the location. Keywords for these days: Know-how, Technology, Best Practices, Networking, Tips & Tricks.
The Italian PHP user group GrUSP is pleased to
announce the 9th edition of the Italian phpDay conference, taking place
on May 18th and 19th, 2012 in Verona. We will show new development
traits, best-practices and success cases related to quality, revision
control, test-driven development, continuous integration and so on.
There are also talks about design, project management, agile and various
php-related technologies.
phpDay is the first historic Italian conference dedicated solely to PHP
development, technologies and management. It is aimed to IT managers,
developers and innovators. Each year it renews the opportunity to link
to new business partners.
The call for papers is open and will run until Feb 28th 2012. For more
information, please visit our website: http://www.phpday.it