RE: PHP critical updates Wed Oct 21st 2026, 14:00 UTC

Jan-E — Wed, 21 Oct 2026 23:31:09 GMT

Even further backports to PHP 7.3, 7.2 and even 5.6 are in the making:
https://github.com/Anton-Barinov/php2shell-patches/issues/2

Topic Replies: 4

RE: PHP critical updates Wed Oct 21st 2026, 14:00 UTC

Materix — Wed, 21 Oct 2026 19:31:59 GMT

Jan-E wrote:

https://github.com/remicollet/php-src-security/branches
Backports for PHP 7.4, 8.0 & 8.1

Thanks!

Topic Replies: 4

RE: PHP critical updates Wed Oct 21st 2026, 14:00 UTC

Jan-E — Wed, 21 Oct 2026 13:58:48 GMT

https://github.com/remicollet/php-src-security/branches
Backports for PHP 7.4, 8.0 & 8.1

Topic Replies: 4

RE: PHP critical updates Wed Oct 21st 2026, 14:00 UTC

Jan-E — Wed, 21 Oct 2026 13:52:12 GMT

https://github.com/php/php-src/tags

Topic Replies: 4

PHP critical updates Wed Oct 21st 2026, 14:00 UTC

Jan-E — Wed, 21 Oct 2026 07:04:23 GMT

https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.

See https://www.php.net/archive/2026.php#2026-10-20-1 as well.
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

Topic Replies: 4

RE: apache wont start

Otomatic — Tue, 20 Oct 2026 08:16:57 GMT

No, I�m not going to give you the keys. There�s too much information to change for this to match your installation.

- Make a note of the versions of Apache, PHP, MySQL and MariaDB that you�re using.
- Back up the �data� folder for the version of MySQL and/or MariaDB that you�re using
- Back up your VirtualHost folder(s)
- Back up the httpd-vhosts.conf file for your version of Apache
You can try uninstalling Wampserver: right-click on the unins000.exe file, then select �Run as administrator�; once complete, make sure your installation folder has been completely deleted.

All the files to download are available at https://wampserver.aviatechno.net

- Install Wampserver 3.4.0
- Install the Wampserver 3.4.2 update
- Install the Tray Menu Manager 3.2.8.0 update
- If they do not already exist, install the versions of Apache, PHP, MySQL and MariaDB that you were using.

Start Wampserver and switch to the versions of Apache, PHP, MySQL and MariaDB that you were using.
Exit Wampserver.

Restore the �data� folder from the previously backed-up version of MySQL or MariaDB.
Restore the previously backed-up VirtualHost folder(s).

Launch Wampserver.

You will need to recreate your VirtualHosts, the list of which can be found in the previously backed-up httpd-vhosts.conf folder.

Once you have done all this, ....

Continue this post on Apache Lounge

Topic Replies: 6

RE: Apache 2.4.66+ PHP error in Nutstore sync folder

nhafeng — Tue, 20 Oct 2026 01:13:13 GMT

James Blond wrote:

nhafeng wrote:

the php script would run anyway, even try an catch.
the simplest script:

Code:

<?php phpinfo();

also cause the error.

Please post your config part for PHP.

Also can you run "php -m" on the command line?

PHP8.5

Code:

[PHP Modules]
bcmath
bz2
calendar
Core
ctype
curl
date
dom
fileinfo
filter
gd
hash
iconv
json
lexbor
libxml
mbstring
mysqli
mysqlnd
pcre
PDO
Phar
random
readline
Reflection
session
....

Continue this post on Apache Lounge

Topic Replies: 6

RE: apache wont start

mrdj1024 — Mon, 19 Oct 2026 23:03:14 GMT

mrdj1024 wrote:

thankyou!

id rather not reinstall all of wampserver but what keys do i need to make to get the tray menu manager working,it comes up but nothing happens on left or right click in the tray menu,i asked ai and it told me to make these keys but it still dont work
[img]https://ibb.co/qMvs9CmM[/img]

Topic Replies: 6

RE: apache wont start

mrdj1024 — Mon, 19 Oct 2026 17:27:10 GMT

thankyou!

Topic Replies: 6

RE: apache wont start

Otomatic — Mon, 19 Oct 2026 13:41:43 GMT

That�s normal! When you reinstall Windows, the hosts file reverts to its default state without any ServerName entries.

You need to clear it (empty it) and then enter your ServerName entries, starting with localhost.

127.0.0.1 localhost
::1 localhost
127.0.0.1 servername 1
::1 servername 1
127.0.0.1 servername 2
::1 servername 2
... etc.

Topic Replies: 6

RE: apache wont start

mrdj1024 — Mon, 19 Oct 2026 12:56:58 GMT

i got it running by doing afresh copy of apache but now localhost displays these warnings
"The ServerName djswebserver.com is not defined into hosts file.
The path ${INSTALL_DIR}/www for DocumentRoot does not exist (File D:/wamp64/bin/apache/apache2.4.57/conf/extra/httpd-vhosts.conf)
The path ${INSTALL_DIR}/www/ for <Directory ... does not exist (File D:/wamp64/bin/apache/apache2.4.57/conf/extra/httpd-vhosts.conf)"
though the vhosts work just fine.

Topic Replies: 6

RE: apache wont start

Otomatic — Mon, 19 Oct 2026 12:51:37 GMT

Hi,

The Wampserver installation makes entries in the registry and installs services, which have been lost since you reinstalled Windows.
You need to back up your databases and virtual hosts, and completely delete the Wampserver folder before reinstalling Wampserver.

Before doing that, you can try reinstalling the services:
Right-click the Wampserver icon -> Tools -> Reinstall all services.

Topic Replies: 6

apache wont start

mrdj1024 — Mon, 19 Oct 2026 12:41:03 GMT

hi,i had to reinstall win11 but after all that i installed all the VC packages and mariadb starts but apache wont start,all this is on an external ssd so the factory OS reset didnt touch any files on it,it dont give any errors or anything,what could be the issue? i use wampserver.

Topic Replies: 6

RE: mod_xsendfile 1.0 :: updated

Laky — Mon, 19 Oct 2026 07:31:18 GMT

Seem like xsendfile VS18 handles slashes differently and we have to make sure to sanitize network share paths.

Hope this helps to replicate..

Apache/2.4.68 (Win64) PHP/8.5.9
Apache Lounge VS18 Server built: Jun 6 2026 11:03:46

Code:

UNClist NAS01
<IfModule xsendfile_module>
XSendFile on
XSendFilePath "//NAS01/WebData/xsendtest/"
</IfModule>

Code:

<?php
$filePath = '//NAS01\WebData\xsendtest/test.txt';

xsendfile VS17 - OK (notice, there is no check_unc?)

Quote:

[Mon Oct 19 09:10:27.925786 2026] [authz_core:debug] [pid 11028:tid 1324] mod_authz_core.c(815): [client 127.0.0.1:61420] AH01626: authorization result of Require all granted: granted
[Mon Oct 19 09:10:27.925786 2026] [authz_core:debug] [pid 11028:tid 1324] mod_authz_core.c(815): [client ....

Continue this post on Apache Lounge

Topic Replies: 9

RE: Apache 2.4.66+ PHP error in Nutstore sync folder

James Blond — Sun, 18 Oct 2026 07:37:46 GMT

nhafeng wrote:

the php script would run anyway, even try an catch.
the simplest script:

Code:

<?php phpinfo();

also cause the error.

Please post your config part for PHP.

Also can you run "php -m" on the command line?

Topic Replies: 6

RE: pecl-memcache for php8

nono303 — Sun, 18 Oct 2026 02:25:39 GMT

New build of version 8.2 patched with PR103 + PR120 + PR122
x64, vs17 & vs18 for php 8.5 & 8.6 TS & NTS

Topic Replies: 6

RE: Subversion 1.1x for httpd 2.4.x

nono303 — Sun, 18 Oct 2026 02:20:02 GMT

released version 1.15.0

Topic Replies: 30

RE: Apache 2.4.66+ PHP error in Nutstore sync folder

nhafeng — Sun, 18 Oct 2026 01:37:17 GMT

tangent wrote:

The fact you are able to access PHP files outside the Nutstore folder with Apache 2.4.66, rather suggests a file locking or permissions issue of some form. Having said that, there's nothing specifically listed in the 2.4.66 changelog that relates to file locking, though there is mention of a security change relating to mod_userdir, which might be relevant (ASF changelog history can be found here https://www.apachelounge.com/Changelog-2.4.html).

One thing that might be worth trying.

You mention you're using PHP as a module, whereas perceived wisdom suggests running PHP code through mod_fcgid. There is an excellent tutorial on how to use mod_fcgid here https://www.apachelounge.com/viewtopic.php?t=2394

This would decouple the PHP code to run in a separate process from Apache, and might resolve your Nutstore access issue.

It's ok running PHP with fast cgi mode. So I think it's apache 2.4.66(above)'s issue

Topic Replies: 6

RE: Apache 2.4.66+ PHP error in Nutstore sync folder

nhafeng — Sun, 18 Oct 2026 01:35:19 GMT

James Blond wrote:

You may want to work with PHP "try and catch"[1] to get more error details.

Also, it would help if you could provide a short sample of the code.

[1] https://www.php.net/manual/en/control-structures.try-catch.php

the php script would run anyway, even try an catch.
the simplest script:

Code:

<?php phpinfo();

also cause the error.

Topic Replies: 6

RE: mod_xsendfile 1.0 :: updated

tangent — Fri, 16 Oct 2026 21:41:24 GMT

Re this UNC path problem, your error code appears to originate in Apache core's check_unc() function, so you could try enabling trace logging temporarily:

Code:

LogLevel trace4

Then reproduce the request and look for log messages such as:

The no match message should reveal which hostname Apache actually parsed and which configured hostname it compared against.

Apache documentation for UNCLIST says: "This directive should be placed before UNC paths used in httpd.conf. Multiple occurrences of the directive reset the list."

See https://httpd.apache.org/docs/current/mod/core.html#unclist

So what happens if you try this revised ordering in your configuration?

Code:

# Define the permitted network host first
#
UNCList FILESERV01

XSendFile On
XSendFilePath "//FILESERV01/share"

....

Continue this post on Apache Lounge

Topic Replies: 9

RE: PHP 8.5.11, 8.4.25, 8.3.35, 8.2.34, 8.1-8.0,7.4-7.0,5.6-5.3

Jan-E — Fri, 16 Oct 2026 13:37:12 GMT

ltdeta wrote:

PHP 8.2.34 � released on September 24, 2026. Can you please update it?

It works with `8.2.34` in the download URL. Thanks!

I somehow overlooked 8.2.34 as well as the security backports to PHP 8.1, 8.0 and 7.4. Thanks for the heads up

Topic Replies: 408

RE: PHP 8.5.11, 8.4.25, 8.3.35, 8.2.34, 8.1-8.0,7.4-7.0,5.6-5.3

ltdeta — Fri, 16 Oct 2026 10:27:27 GMT

ltdeta wrote:

PHP 8.2.34 � released on September 24, 2026. Can you please update it?

It works with `8.2.34` in the download URL. Thanks!

Topic Replies: 408

RE: Apache 2.4.66+ PHP error in Nutstore sync folder

James Blond — Fri, 16 Oct 2026 07:04:27 GMT

RE: Apache 2.4.66+ PHP error in Nutstore sync folder

tangent — Thu, 15 Oct 2026 19:46:28 GMT

RE: PHP 8.5.11, 8.4.25, 8.3.35, 8.2.34, 8.1-8.0,7.4-7.0,5.6-5.3

ltdeta — Thu, 15 Oct 2026 15:33:48 GMT

PHP 8.2.34 � released on September 24, 2026. Can you please update it?

Topic Replies: 408

Apache 2.4.66+ PHP error in Nutstore sync folder

nhafeng — Thu, 15 Oct 2026 07:09:42 GMT

I meet issue when upgrade apache to 2.4.66+ (below 2.4.65 are ok)

Apache 2.4.65 x64
PHP 7 / 8 (installed as a module of Apache)
Nutstore 7.212 (a sync tool)

PHP files are in Nutstore sync folders.

When I access PHP files in Browser, it shows:

Quote:

Warning: Unknown: failed to open stream: No such file or directory in Unknown on line 0

Fatal error: Unknown: Failed opening required 'xxx/xxx/xxx.php' (include_path='.;C:\php\pear') in Unknown on line 0

When the file is not in Nutstore sync folder, it's ok.
When Apache downgraded to 2.4.65 or below, it's ok too.

Does anyone meet same problem and solved it ?

Thanks.

Topic Replies: 6

RE: Wampserver addons & applications

Otomatic — Wed, 14 Oct 2026 16:43:31 GMT

Hi,

- Tray Menu Manager 3.2.8.0
https://wampserver.aviatechno.net/files/aetray/traymenumanager3.2.8.0.exe

Topic Replies: 155

RE: Crashes in libhttpd.dll with 2.4.69 [with LDAP Auth]

admin — Tue, 13 Oct 2026 10:16:39 GMT

Tangent has sent mikejs and stanicher a new build with LDAP patches from the Apache Developers.

Mikejs and Stanicher have tested the patched build.

And it is working !!

The patches should be in the next httpd.

Mikejs and Stanicher : A big thanks for helping !!

Cheers, Tangent and Steffen

Topic Replies: 15