php 安全漏洞CVE-2026-109618、CVE-2026-109619 修复。
php版本更新
| 漏洞情况 | |
|---|---|
| 漏洞描述 | 两个漏洞均与 PHP 请求生命周期边界上的状态管理缺陷有关： CVE-2026-109618 利用内存耗尽（OOM）时的 longjmp() 提前退出，使尚未完成初始化的请求内存在 request shutdown 阶段被错误消费； CVE-2026-109619 利用 worker 全局状态在请求结束后未正确重置，使后续请求在正常初始化之前访问已释放的请求内存。攻击者无需认证，通过构造恶意 HTTP 请求即可触发释放后重用（UAF），进而实现内存泄露和远程代码执行。 |
| 影响版本 | PHP < 8.2.35 PHP < 8.3.36 PHP < 8.4.27 PHP < 8.5.12 仍在维护的分支： PHP 8.5、8.4、8.3 仍处于现行维护期，应优先升级到对应修复版本或更高版本。8.2.35 是当前可用的修复版本，也是 8.2 分支最后的升级时间窗口之一；建议尽快规划升级到 8.3 或更高版本。 已停止维护的分支： PHP 8.1、8.0、7.4 及更早版本已停止官方支持，PHP 官方不再发布修复版本。 PHP ≤ 7.3 / 5.x 同样已停止维护，官方不提供修复版本，应优先升级。 |
PHP 兼容性与 WordPress 版本——打造 WordPress 核心
add atp sources
如何在Ubuntu 26.04、24.04和22.04上安装PHP 8.5 – LinuxCapable
(
set -e
. /etc/os-release
arch="$(dpkg --print-architecture)"
case "$ID:$VERSION_CODENAME:$arch" in
ubuntu:resolute:amd64|ubuntu:resolute:arm64|ubuntu:noble:amd64|ubuntu:noble:arm64|ubuntu:noble:armhf|ubuntu:jammy:amd64|ubuntu:jammy:arm64|ubuntu:jammy:armhf)
key_file="$(mktemp)"
trap 'rm -f -- "$key_file"' EXIT
curl -fsSLo "$key_file" https://packages.sury.org/php/apt.gpg
sudo install -m 0755 -d /etc/apt/keyrings
sudo install -m 0644 "$key_file" /etc/apt/keyrings/deb.sury.org-php.gpg
printf '%s\n' \
'Types: deb' \
'URIs: https://packages.sury.org/php/' \
"Suites: $VERSION_CODENAME" \
'Components: main' \
"Architectures: $arch" \
'Signed-By: /etc/apt/keyrings/deb.sury.org-php.gpg' | sudo tee /etc/apt/sources.list.d/php.sources > /dev/null
;;
*)
printf 'No source written: supported hosts are Ubuntu 26.04 amd64/arm64 and Ubuntu 24.04/22.04 amd64/arm64/armhf; this host reports %s/%s/%s.\n' "$ID" "$VERSION_CODENAME" "$arch" >&2
exit 1
;;
esac
)sudo apt update
# apt install php8.5-fpm
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
php-common php8.5-cli php8.5-common php8.5-readline
The following NEW packages will be installed:
php8.5-cli php8.5-common php8.5-fpm php8.5-readline
The following packages will be upgraded:
php-common
1 upgraded, 4 newly installed, 0 to remove and 104 not upgraded.
Need to get 7273 kB of archives.
After this operation, 35.0 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
#
apt install php8.5-mysql php8.5-zip php8.5-gd php8.5-mbstring php8.5-curl php8.5-xml php8.5-bcmath# php8.5 --version
PHP 8.5.12 (cli) (built: Oct 21 2026 08:08:15) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.5.12, Copyright (c) Zend Technologies
with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies
# php-fpm8.5 --version
PHP 8.5.12 (fpm-fcgi) (built: Oct 21 2026 08:08:15) (NTS)
Copyright (c) The PHP Group
Built by Ubuntu
Zend Engine v4.5.12, Copyright (c) Zend Technologies
with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies# phpinfo 验证
# cat info.php
<?php
phpinfo();
?>
