php

Category: adapted. Forked 2026-10-22 from official Arch’s own php package (pkgbase php, maintainer Pierre Schmitz, 16 subpackages: php, php-cgi, php-apache, php-fpm, php-embed, php-phpdbg, php-dblib, php-enchant, php-gd, php-sodium, php-odbc, php-pgsql, php-snmp, php-sqlite, php-tidy, php-xsl) – NOT related to [[php74]]/[[php85]], which are a completely separate el_aur/arch-phpbs-generated family meant to install side-by-side with the system default php. This package IS the system default php.

Why this exists (CVE-2026-109618 / CVE-2026-109619 response)

See [[php74]]/[[php85]] for the full CVE writeup (“php2shell”, critical bailout-during-OOM state corruption RCE). Official Arch’s extra/php shipped the real fix same-day as 8.5.12-1 (2026-10-21), and Arch Linux ARM (ALARM) already rebuilds it: confirmed via pacman -Si php directly on our own ARM build boards – aarch64 (eurobuild14) was already at 8.5.12-1, fully patched – but armv7h (eurobuild5) was still at 8.5.11-1, one point release behind and still vulnerable.

Initially (see [[php85]]) tried solving “PHP 8.5 on ARM” by vendoring and ARM-porting the el_aur/arch-phpbs php85 package instead – that turned out to be solving the wrong problem: php85 exists to let a different-versioned PHP coexist alongside the system default, which nothing on these boards actually needs for this CVE response. Once it was clear aarch64 was already a non-issue and armv7h just needed one version bump, the much simpler fix was to fork the plain official php PKGBUILD (the exact one ALARM itself uses) and build that for armv7h ourselves, rather than wait for ALARM’s own armv7h build to catch up.

What was actually changed vs upstream

• arch=('x86_64') -> arch=('x86_64' 'armv7h'). That’s it – no patch, no pkgver/pkgrel deviation (pkgrel stays 1, matching upstream exactly, since there’s no real content difference, just an arch unlocked that upstream’s own PKGBUILD metadata doesn’t declare even though ALARM’s build tooling demonstrably builds it fine there already – same reasoning as the existing svt-av1 adapted/ entry, not the php74/android-file-transfer X.Y-pkgrel pattern).
• makedepends already included everything needed (libtiff, etc.) – no Firebird/libfbclient dependency at all in this package (unlike php85), so none of that mess applies here.
• validpgpkeys (3 php.net signing keys) resolved cleanly via scripts/update_pgp_key_dir.sh run from the package dir, no issues.
• Source tarball checksum (php-8.5.12.tar.xz, 08bc2eba2a588654ade1357174aa646b761556c862dda0678345ee29ed481209) already matched what official Arch’s own PKGBUILD listed – confirms this really is the same, unmodified, officially-vetted 8.5.12 release.

Open question

Only armv7h was added – aarch64 wasn’t, since ALARM already serves a fully-patched 8.5.12-1 there directly; no reason to also publish our own copy unless ALARM’s aarch64 build later falls behind again.