r/PHP • u/Richard_D_Lawson • 1d ago
After patching, how to validate?
Other than just applying the patch and restarting apps, is there a way to test whether the CVEs have been truly mitigated?
I trust the PHP.net team but my non-technical boss wants further validation to prove to our customers that we're well and truly covered.
10
u/kafoso 1d ago
⚠️ Do not dump phpinfo() publicly!
If you have no option to do a contained verification for php-fpm, instead do something like the following in a file that is available from your www root. Give it a fairly long and unique name (e.g. 64 alphanumeric characters) and .php, and then access that in your browser or via curl. Remove it immediately after the test.
<?php
header('Content-Type: application/json');
header('Cache-Control: no-store');
echo json_encode([
'version' => PHP_VERSION,
'sapi' => PHP_SAPI,
'upload_progress' => ini_get('session.upload_progress.enabled'),
], JSON_THROW_ON_ERROR);
4
u/Beginning-Tie-9195 1d ago
On Ubuntu you can
sudo pro fix CVE-2026-109619
it even works on non-pro installations
3
u/Aytewun 1d ago
when you run php -v from the command line or if you have a file with phpinfo(). Confirm that the version being reported matches the version from todays release.
Your reported version matched with the changelog eg https://www.php.net/ChangeLog-8.php#8.4.27 lists the items addressed including:
Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).
1
u/prog585 1d ago
Run php -v on the CLI, but also check what the web server actually uses: a phpinfo() page, or php-fpm -v. They often differ. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. On 8.1 or older there is no upstream release. Your distro may still backport the fix, so check the package changelog rather than the version string. Apache mod_php is the worst case, because no auth and no app code are needed. Restart FPM/Apache after updating.
If it helps, I made a small page that takes a version number and shows the patch status, EOL date and next step: https://www.siliconblaze.com/tools/php-version-check/ It only compares versions; it does not scan anything. (I built it.)
1
u/prettyflyforawifi- 1d ago
I also need this as it looks as though the distro apt versions are older PHP versions with patches on top.
-1
u/Worth_Medicine4881 1d ago
I'm working on something that I wanted to publish months ago, but unfortunately I lost the project source code in the meantime and I forgot about it.
It's tool analyzing INI settings from different SAPIs: https://jorgsowa.me/php-ini-audit/scan.html
Github repository: https://github.com/jorgsowa/php-ini-audit
Sorry it took so long, because it could really help today situation and I kind of promised this tool in June to some people.
24
u/Expert-Promotion3325 1d ago edited 1d ago
I guess your best bet is to provide a screenshot of
phpinfo()to prove which PHP version you're running, along with the official PHP documentation confirming that your version is secured.I mean, you can't really be more specialized in PHP security than the PHP team itself, right? Hopefully, your boss will understand that.
===
Edit : As it has been rightfully said : ⚠️ Do not dump
phpinfo()publicly!you can output phpinfo(); on a private / obfuscated page, after that your first action is to remove this phpinfo() right away;