牛马论坛查看原帖 →

我对 PHP 5.4 修复 CVE-2026-109618 和 CVE-2026-109619 的过程

打工人 5 阅读 1 回复
1 、下载:从 [url=https://museum.php.net/php5/php-5.4.45.tar.gz]https://museum.php.net/php5/php-5.4.45.tar.gz[/url] 下载 PHP 5.4 的最新版本,从 [url=https://github.com/vperetti/php-cve-2026-109618-109619-backports]https://github.com/vperetti/php-cve-2026-109618-109619-backports[/url] 下载 patch 文件
2 、打补丁:将php-5.4.45 目录php-5.4-CVE-2026-109618-109619.patch 文件放到同一个目录下,进入 php-5.4.45 目录,然后patch -p1 < ../php-5.4-CVE-2026-109618-109619.patch
3 、配置编译参数:在原来的 PHP 5.4 里,php -i | grep Configure 看到编译参数,比如我的是./configure --prefix=/www/server/php/54 --with-config-file-path=/www/server/php/54/etc --enable-fpm --with-fpm-user=www --with-fpm-group=www --with-mysql=mysqlnd --with-mysqli=mysqlnd --with-pdo-mysql=mysqlnd --with-iconv-dir --with-freetype-dir=/usr/local/freetype --with-jpeg-dir --with-png-dir --with-zlib --with-libxml-dir=/usr --enable-xml --disable-rpath --enable-bcmath --enable-shmop --enable-sysvsem --enable-inline-optimization --with-curl=/usr/local/curl --enable-mbregex --enable-mbstring --with-mcrypt --enable-ftp --with-gd --enable-gd-native-ttf --with-openssl=/usr/local/openssl --with-mhash --enable-pcntl --enable-sockets --with-xmlrpc --enable-zip --enable-soap --with-gettext --disable-fileinfo --enable-intl --build=arm-linux
4 、编译:然后通过 make -j$(nproc) 进行编译我的是 4 核,也可以 make -j3 ,这样留给其他程序一点 CPU 资源
5 、停止原来的 PHP-FPM ,并备份原来的目录
6 、安装:make install
会输出Installing PHP CLI binary: /www/server/php/54/bin/Installing PHP CLI man page: /www/server/php/54/php/man/man1/Installing PHP FPM binary: /www/server/php/54/sbin/Installing PHP FPM config: /www/server/php/54/etc/Installing PHP FPM man page: /www/server/php/54/php/man/man8/Installing PHP FPM status page: /www/server/php/54/php/fpm/Installing PHP CGI binary: /www/server/php/54/bin/Installing PHP CGI man page: /www/server/php/54/php/man/man1/Installing build environment: /www/server/php/54/lib/php/build/Installing header files: /www/server/php/54/include/php/Installing helper programs: /www/server/php/54/bin/program: phpizeprogram: php-configInstalling man pages: /www/server/php/54/php/man/man1/page: phpize.1page: php-config.1Installing PEAR environment: /www/server/php/54/lib/php/[PEAR] Archive_Tar - already installed: 1.3.12[PEAR] Console_Getopt - already installed: 1.3.1[PEAR] Structures_Graph- already installed: 1.0.4[PEAR] XML_Util - already installed: 1.2.3[PEAR] PEAR - already installed: 1.9.5Warning! a PEAR user config file already exists from a previous PEAR installation at '/root/.pearrc'. You may probably want to remove it.Wrote PEAR system config file at: /www/server/php/54-patch/etc/pear.confYou may want to add: /www/server/php/54/lib/php to your php.ini include_path/www/server/php/php-5.4.45/build/shtool install -c ext/phar/phar.phar /www/server/php/54/binln -s -f /www/server/php/54/bin/phar.phar /www/server/php/54/bin/pharInstalling PDO headers: /www/server/php/54/include/php/ext/pdo/
如果原来的 php.ini 修改了的,就复制到新的里面
7 、重新启动 PHP-FPM


⚠️内容来自互联网,如有侵权请点击反馈![url=source/plugin/aljreport/index.html]侵权投诉[/url]
5.4 都还在打补丁,这是宝塔老机器吧?打之前最好先 php -v 记下版本,patch 完再跑一遍你的业务脚本验证,光看编译过不算数。另外问下这 patch 是官方 backport 还是社区做的,来源靠不靠谱很关键。
[这只是一个小尾巴]

阅读全文与全部回复 →