alt-php80 (8.0.30-70) stable; urgency=high

  * SECURITY UPDATE: security hardening in the memory allocator and the
    multipart request parser
    - debian/patches/php-8.0-CVE-2026-109618-109619.patch: report
      allocation failures without re-entering the engine from the allocator
      error path, and take substring_conf()'s length as size_t rather
      than int; upstream 82f8f31b (PHP 8.0 branch)
      also disables the session upload-progress callback as upstream does on
      the EOL branches, so session.upload_progress.enabled no longer has
      any effect
    - CVE-2026-109618
    - CVE-2026-109619

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 21 Oct 2026 06:00:00 +0000

alt-php80 (8.0.30-69) stable; urgency=high

  * SECURITY UPDATE: multiple out-of-bounds reads in the mysqlnd wire protocol
    parser - a malicious or compromised MySQL server could send a truncated
    packet and make the client read past the end of the packet buffer
    - debian/patches/php-8.0-CVE-2025-1218.patch: backport upstream commit
      114dbb7436 in ext/mysqlnd/. Replaces the after-the-fact
      BAIL_IF_NO_MORE_DATA check with a BAIL_IF_NOT_ENOUGH_DATA_EX(n) family
      that refuses the read before it happens, adds a remaining_size parameter
      to php_mysqlnd_net_field_length()/_ll() so the 2/3/8-byte length prefixes
      are bounds-checked, and adds the missing checks in greet_read (server
      version, MariaDB RPL prefix, the fixed 31-byte block, the extended
      scramble and the auth plugin name), auth_response_read, ok_read,
      eof_read, rset_header_read, the READ_RSET_FIELD metadata macro,
      rowp_read and its text-protocol field lengths, chg_user_read and
      cached_sha2_result_read. In mysqlnd_ps_codec.c the new
      ps_fetch_is_length_too_short() makes the prepared-statement
      time/date/datetime fetchers reject a declared field length that is
      shorter than the fixed offsets they read. The mysqlnd_ps.c hunk is a
      memory-leak fix on the failure path the new checks make reachable, not
      an over-read fix; the prepare_read() and
      sha256_pk_request_response_read() hunks are hardening only - the former
      provably cannot fire behind the existing PREPARE_RESPONSE_SIZE gate and
      the latter is a strictness change. Carries all 38 upstream
      ghsa-r6x9-5r99-36j7 phpt tests plus ext/mysqli/tests/fake_server.inc,
      imported in full from upstream because the tests load it by that path.
      This branch already carries an older, 870-line fake_server.inc at
      ext/standard/tests/mysqli/ from the CVE-2024-8929 backport; that copy
      predates upstream's dynamic-port API, so the two coexist rather than
      one being rewritten to serve both. 14 of the
      38 have the last one or two lines of their expected output adapted,
      because mysqli on 8.0 does not throw on a failed connect and does not
      populate the error message the 8.2 expectations print.
    - Also fixes a pre-existing use-after-free on the row-reader failure path.
      The CVE-2024-8929 backport added error loops in the binary- and
      text-protocol row readers that zval_ptr_dtor() every field decoded so far
      and return FAIL without clearing the zvals, so the result set frees the
      same zvals again when it is torn down. The loops were already reachable
      before this change; the new too-short TIME/DATE/DATETIME check adds a
      second way in. All 3 sites now clear the zval after freeing it.
      Confirmed under AddressSanitizer with the Zend allocator disabled:
      heap-use-after-free in mysqlnd_result_buffered_zval free_result before,
      clean after, on both the three new short-length tests and the nine
      CVE-2024-8929 stmt-row tests. Upstream still carries the same loops
      unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected.
    - CVE-2025-1218
  * debian/rules: build with -O2. The deb build never set an optimisation
    level (only -fno-strict-aliasing/-fPIC/... were appended to CFLAGS), so
    gcc compiled everything at its -O0 default. Unoptimised binaries failed
    the perftest on ubuntu26.04 (alt-php80 took 3.85x the time of the distro
    PHP 8.5.4 against a 2.55x limit). RPM (optflags, -O2) and Alpine (-Os)
    builds were already optimised and are unchanged.

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Mon, 05 Oct 2026 12:49:08 +0000

alt-php80 (8.0.30-68) stable; urgency=medium

  * ALTEAPLN-71: no change to the Debian packaging. php.d.std inis are not
    conffiles, so dpkg replaces them on every upgrade and an edited pdo.ini
    is not carried over to 20-pdo.ini. Recorded for parity with the RPM side,
    which now moves an edited pdo.ini.rpmsave over 20-pdo.ini.

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 05 Oct 2026 12:00:00 +0000

alt-php80 (8.0.30-67) stable; urgency=high

  * SECURITY UPDATE: out-of-bounds read on an empty Location header when the
    http:// wrapper follows a relative redirect
    - debian/patches/php-8.0-CVE-2026-93682.patch: backport upstream commits
      8196275133 and de3436c76e in ext/standard/http_fopen_wrapper.c - use
      header_info.location_len instead of strlen() and reading location[1],
      so an empty Location header no longer over-reads the heap. Net effect of
      both commits: the relative-join check is location_len > 1. Carries the
      upstream http_empty_location_redirect.phpt and
      http_single_char_location_redirect.phpt tests, adapted to include
      ServerClientTestCase2.inc.
    - CVE-2026-93682
  * SECURITY UPDATE: FastCGI listen.allowed_clients compared only the first
    96 bits of IPv6 addresses
    - debian/patches/php-8.0-CVE-2026-91768.patch: backport upstream commit
      dcdfcf86fc in main/fastcgi.c - compare the full sizeof(sin6_addr) in
      fcgi_is_allowed(). Carries the upstream ghsa-62xp-839h-2637 FPM tests,
      adapted to this branch's log matcher (child \d+ in place of the
      printf-style placeholder).
    - CVE-2026-91768

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 30 Sep 2026 12:00:00 +0000

alt-php80 (8.0.30-66) stable; urgency=high

  * SECURITY UPDATE: the http:// wrapper forwarded Authorization, Cookie and
    Proxy-Authorization headers across a cross-origin redirect
    - debian/patches/php-8.0-CVE-2026-91766.patch: backport upstream commit
      5af9465ca8 in ext/standard/http_fopen_wrapper.c - compare the redirect
      target's scheme, host and effective port against the current URL and
      strip the credential headers from the user header bag when they differ,
      with a line-aware strip_header() that also removes repeated and folded
      occurrences. Adapted: this branch has no HTTP_WRAPPER_KEEP_METHOD
      flag, so only the new_flags computation is introduced. Carries upstream's
      matching ext/standard/tests/http/bug61548.phpt expectation update.
    - CVE-2026-91766
  * SECURITY UPDATE: out-of-bounds read in the wildcard certificate name
    matcher
    - debian/patches/php-8.0-CVE-2026-91767.patch: backport upstream commit
      78cc82b37a in ext/openssl/xp_ssl.c - account for the wildcard prefix
      length before the memchr() range is computed, so an overlapping prefix
      and suffix can no longer underflow it to SIZE_MAX.
    - CVE-2026-91767
  * SECURITY UPDATE: peer verification fell back to the certificate CN even
    when the certificate presented a DNS, URI or SRV service identity
    - debian/patches/php-8.0-CVE-2026-91769.patch: backport upstream commit
      0bb308eb4c in ext/openssl/xp_ssl.c - php_openssl_matches_san_list()
      reports whether the certificate carries a service identity and the
      verification policy fails instead of matching the CN when it does
      (RFC 6125 6.4.4). Adapted: the matcher functions take zend_bool and
      this branch has no HAVE_IPV6_SAN block.
    - CVE-2026-91769

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Tue, 29 Sep 2026 12:00:00 +0000

alt-php80 (8.0.30-65) stable; urgency=medium

  * SECURITY UPDATE: heap buffer over-read in convert stream filters
    - debian/patches/php-8.0-CVE-2026-92842.patch: copy line-break-chars with
      pestrndup() instead of the NUL-terminated pestrdup() in the
      base64-encode, quoted-printable-encode and quoted-printable-decode
      filter constructors in ext/standard/filters.c, so an embedded NUL no
      longer leaves lbchars_len longer than the copied buffer.
    - CVE-2026-92842
  * SECURITY UPDATE: integer overflow in SOAP HTTP chunked body handling
    - debian/patches/php-8.0-CVE-2025-14181.patch: sum the body length in a
      size_t, bound every growth step against ZSTR_MAX_LEN and use
      zend_string_safe_realloc()/zend_string_safe_alloc() in get_http_body()
      and make_http_soap_request() in ext/soap/php_http.c.
    - CVE-2025-14181
  * SECURITY UPDATE: phar tar entry injection
    - debian/patches/php-8.0-CVE-2026-6103.patch: reject tar entry sizes that
      cannot be parsed or represented, refuse GNU long link records, bound
      ././@LongLink names by the archive size and skip the data blocks of
      every entry type that carries data in ext/phar/tar.c and
      ext/phar/phar_internal.h.
    - CVE-2026-6103
  * SECURITY UPDATE: unbounded recursion in SOAP XML parsing and decoding
    - debian/patches/php-8.0-CVE-2026-91765.patch: make cleanup_xml_node() and
      get_node_with_attribute_recursive_ex() iterative, reject documents
      nested deeper than 2048 levels on libxml2 < 2.13, and cap the encoder's
      decode depth in ext/soap/php_xml.c, php_encoding.c, php_soap.h and
      soap.c.
    - CVE-2026-91765

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 28 Sep 2026 12:00:00 +0000

alt-php80 (8.0.30-64) stable; urgency=medium

  * ALTPHP-2151: no change to the Debian packaging - the equivalent restore
    already lives in the alt-php80-php-fpm postinst (EA4D-825), and dpkg runs
    postinst after the replaced package's prerm, so it can repair the unit
    inline. Recorded for parity with the RPM side, where the obsoleted
    alt-php80-fpm package's preun scriptlet stops and disables
    alt-php80-fpm.service after the replacement's post scriptlet has already
    run; the state is now recorded in post and restored in posttrans, the only
    scriptlet that runs after the erase.
  * ALTEAPLN-71: ship php.d.std/pdo.ini as php.d.std/20-pdo.ini. php.d.std/ is
    scanned in name order and its inis carry no dependency lines, so
    nd_pdo_mysql.ini loaded before pdo.ini and nd_pdo_mysql.so failed to load
    without the PDO symbols.

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 23 Sep 2026 12:00:00 +0000

alt-php80 (8.0.30-63) stable; urgency=medium

  * CVE-2025-1735: missing escaping error checks in ext/pgsql and
    ext/pdo_pgsql. PQescapeStringConn() was called with a NULL error argument
    and the NULL returns of PQescapeByteaConn()/PQescapeIdentifier() were
    ignored, so input that is invalid in the connection encoding was
    interpolated into SQL only partially escaped; thread an error argument
    through every escape call and fail the operation instead
  * CVE-2026-7258: undefined behaviour from passing plain char to the ctype.h
    classification functions. Bytes >= 0x80 sign extended to negative ints in
    php_url_decode()/php_raw_url_decode() and many other call sites, which is
    outside the domain of isxdigit() and friends and can index outside the
    libc classification table; cast every ctype.h argument to unsigned char

 -- Viktor Borzov <vborzov@cloudlinux.com>  Wed, 02 Sep 2026 12:00:00 +0200

alt-php80 (8.0.30-62) stable; urgency=medium

  * ALTPHP-2594: stop shipping the default www pool. rules now ships
    www.conf.default, the postinst derives www.conf from it only where cPanel
    is absent and never overwrites an existing one, and the postrm removes it
    on remove/purge. On a cPanel host neither www.conf nor the _.conf
    placeholder exists, so a version with no FPM domain owns no pool - the
    shape ea-php ships.

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 31 Aug 2026 12:00:00 +0000

alt-php80 (8.0.30-61) stable; urgency=medium

  * ALTEAPLN-3: no change to the Debian packaging - alt-php80-cli has never
    depended on the FPM package here. Recorded for parity with the RPM side,
    where a hard Requires was dropped so the FPM package can be removed on
    servers that only use PHP Selector via lsapi
  * ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php80/root/etc/php-fpm.d/_.conf placeholder in the
    package. cPanel counts any *.conf in that directory as an enabled FPM pool
    and kept restarting alt-php80-fpm through chkservd on servers that never
    use FPM, even with the unit disabled. The alt-php80-php-fpm post-install
    script now creates the file with mode 0644 only when cPanel is absent -
    the only case where it is wanted, to silence php-fpm's include-glob
    warning - and deletes it when cPanel is present. Since no package owns the
    file any more, a new -php-fpm postrm removes it on remove and purge, so a
    stray *.conf cannot be left behind to re-trigger this bug if cPanel is
    installed later
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 18 Aug 2026 16:55:33 +0200

alt-php80 (8.0.30-60) stable; urgency=medium

  * CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped
    PQescapeStringConn() output in an E'...' escape-string constant, where a
    trailing backslash escapes the doubling quote and breaks out of the
    literal; emit a plain '...' literal instead
  * CVE-2026-7260: stack exhaustion in ext/phar. phar_get_link_source()
    followed symlink chains by unbounded tail recursion, so a tar-based phar
    with circular symlinks crashed the process; walk the chain iteratively with
    Floyd cycle detection and return NULL on a loop

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 03 Aug 2026 12:00:00 +0200

alt-php80 (8.0.30-59) stable; urgency=medium

  * ALTPHP-2543: escape the literal % in the CLOS-5752 changelog entry
    (uid%100) so dbpp does not parse it as a macro and abort
    buildsys-pre-build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Thu, 30 Jul 2026 16:00:00 +0200

alt-php80 (8.0.30-58) stable; urgency=medium

  * ALTPHP-2543: add libbrotli-dev build dependency so pkg-config can resolve
    libcurl's brotli requirement (alt-curlssl is built --with-brotli) when
    configuring the curl extension on deb platforms

 -- Sergey Fokin <sfokin@cloudlinux.com>  Thu, 24 Jul 2026 12:00:00 +0200

alt-php80 (8.0.30-57) stable; urgency=medium

  * CLOS-5751: isolated lsphp re-execs via its handler dir (cwd) so the per-domain PHP version applies under LSWS isolation
  * CLOS-5752: fix outside-cagefs site-token shard (uid/100 -> uid%100) to match cagefs.server get_prefix and clcagefslib

 -- Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>  Tue, 28 Jul 2026 12:00:00 +0000

alt-php80 (8.0.30-56) stable; urgency=medium

  * CLOS-5732: make the LSAPI prefork SIGCHLD handler async-signal-safe
    (defer in-handler logging to a ring buffer drained by the accept loop),
    fixing a localtime_r/tzset self-deadlock that stalled worker reaping.

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Mon, 20 Jul 2026 00:00:00 +0000

alt-php80 (8.0.30-55) stable; urgency=medium

  * ALTPHP-2541: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 14 Jul 2026 12:00:00 +0200

alt-php80 (8.0.30-54) stable; urgency=medium

  * SECURITY UPDATE: heap buffer overflow in openssl_encrypt() with AES
    key-wrap padding (aes-*-wrap-pad) ciphers
    - debian/patches/php-8.0-CVE-2026-14355.patch: reserve an extra
      EVP_CIPHER_block_size() block for EVP_CIPH_WRAP_MODE ciphers in
      php_openssl_cipher_update() (ext/openssl/openssl.c) so RFC 5649
      wrap-with-padding output no longer overflows the zend_string buffer.
    - CVE-2026-14355

 -- Juan-Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 09 Jul 2026 11:14:00 +0000

alt-php80 (8.0.30-53) stable; urgency=low

  * ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. The default www.conf pool now listens on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port. On Debian-like distros the pool group is set to nogroup (no nobody group). Ship an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on non-cPanel hosts (suppresses the "Nothing matches" warning).

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 30 Jun 2026 12:00:00 +0200

alt-php80 (8.0.30-51) stable; urgency=low

  * ALTPHP-2352: add php.d.std scan directory for standalone environments

 -- Sergey Fokin <sfokin@cloudlinux.com>  Sun, 21 Jun 2026 12:00:00 +0200

alt-php80 (8.0.30-50) stable; urgency=low

  * ALTPHP-2476: allow libpcre2 for build, guard libpcre3 runtime dep on
    Debian >= 13 / Ubuntu >= 26 where the libpcre3 packages were removed.

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 16 Jun 2026 12:00:00 +0000

alt-php80 (8.0.30-49) stable; urgency=low

  * CLOS-4642: LSWS site-isolation - normalize trailing slash in docroot hash

 -- Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>  Thu, 18 Jun 2026 13:47:08 +0000

alt-php80 (8.0.30-48) stable; urgency=low

  * ALTPHP-2474: Rename www.conf.default to www.conf so FPM starts by default

 -- Sergey Fokin <sfokin@cloudlinux.com>  Thu, 12 Jun 2026 10:00:00 +0000

alt-php80 (8.0.30-47) stable; urgency=low

  * CLOS-4506: Fix lsphp site-isolation ctor overwriting per-vhost DOCUMENT_ROOT
  * ALTPHP-2448: Gate postun per-user PHP Selector reset on Elevate upgrade markers

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 03 Jun 2026 10:00:00 +0000

alt-php80 (8.0.30-46) stable; urgency=medium

  * ALTPHP-2406: use alt-libicu71 for all OS

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 28 May 2026 15:00:00 +0200

alt-php80 (8.0.30-45) stable; urgency=medium

  * EA4D-825: rename alt-phpXY-fpm -> alt-phpXY-php-fpm

 -- Sergey Fokin <sfokin@cloudlinux.com>  Sun, 25 May 2026 12:00:00 +0200

alt-php80 (8.0.30-44) stable; urgency=medium

  * SECURITY UPDATE: soap extension use-after-free via apache:Map duplicate keys
    - debian/patches/php-8.0-CVE-2026-6722.patch: backport upstream commit
      aee3b3ac9b in ext/soap/php_encoding.c — add Z_TRY_ADDREF_P on
      soap_add_xml_ref insertion and change SOAP_GLOBAL(ref_map) destructor
      to ZVAL_PTR_DTOR.
    - CVE-2026-6722
  * SECURITY UPDATE: pdo_firebird SQL injection via NUL bytes in quoted strings
    - debian/patches/php-8.0-CVE-2025-14179.patch: backport upstream commit
      3f40b65323 in ext/pdo_firebird/firebird_driver.c — replace
      strncat/strncpy/strcpy in preprocess() and the quoter with memcpy plus
      explicit length tracking. Adapted to the 8.0 (const char*, size_t)
      preprocess and quoter signatures.
    - debian/patches/php-8.0-firebird-static-inline-classes.patch: build fix
      required for the CVE-2025-14179 backport to be loadable on Debian.
      Upstream PHP-8.0.30 declares the pdo_firebird tokenizer helper as
      `inline char classes(char idx)` without `static`. C99 inline semantics
      require an external definition when the function is not inlined; nothing
      in PHP provides one. The Debian build's CFLAGS lacks `-O*` (falls back
      to gcc's `-O0`), so classes() is emitted as an undefined external
      reference, and pdo_firebird.so fails to load at runtime with "symbol
      lookup error: undefined symbol: classes".
    - CVE-2025-14179
  * SECURITY UPDATE: soap extension NULL pointer dereference via apache:Map
    item missing <value> element
    - debian/patches/php-8.0-CVE-2026-7262.patch: backport upstream commit
      79551ab8b1 in ext/soap/php_encoding.c — fix typo'd null check in
      to_zval_map() (was checking xmlKey, should check xmlValue).
    - CVE-2026-7262
  * SECURITY UPDATE: php-fpm status endpoint XSS via unescaped request_uri
    - debian/patches/php-8.0-CVE-2026-6735.patch: backport upstream commit
      99a5ad7441 in sapi/fpm/fpm/fpm_status.c — escape proc->request_uri
      with php_escape_html_entities_ex() and fix the broken
      "ENT_HTML_IGNORE_ERRORS & ENT_COMPAT" flag (bitwise-AND of two flag
      constants evaluates to 0). Adapted to 8.0's single-bool `encode`
      model (8.0's JSON output branch already writes raw strings; this
      backport only addresses the HTML/XML XSS the CVE describes).
    - CVE-2026-6735
  * SECURITY UPDATE: mbstring NULL pointer dereference in
    php_mb_check_encoding() via mb_ereg_search_init()
    - debian/patches/php-8.0-CVE-2026-7259.patch: backport upstream commit
      79a054eae0 in ext/mbstring/php_mbregex.c — resolve the mbfl encoding
      before storing it in MBREX(current_mbctype_mbfl_encoding) and
      return FAILURE if NULL (encodings supported by Oniguruma but not
      mbfl such as iso-8859-11, UJIS, KOI8-R).
    - CVE-2026-7259
  * SECURITY UPDATE: soap SoapServer use-after-free after header parsing
    failure when SOAP_PERSISTENCE_SESSION is set
    - debian/patches/php-8.0-CVE-2026-7261.patch: backport upstream commit
      db2a7f9348 in ext/soap/soap.c — guard both zval_ptr_dtor(soap_obj)
      call sites in PHP_METHOD(SoapServer, handle) with
      "if (service->soap_class.persistence != SOAP_PERSISTENCE_SESSION)".
      Adapted to 8.0's fault path (extra efree(fn_name) before each dtor).
    - CVE-2026-7261
  * SECURITY UPDATE: metaphone() signed integer overflow on >INT_MAX input
    - debian/patches/php-8.0-CVE-2026-7568.patch: backport upstream commit
      47def8ce1d in ext/standard/metaphone.c — retype w_idx and
      Lookahead's how_far/idx from int to size_t to avoid signed overflow
      while walking strings larger than 2 GB on 64-bit builds.
    - CVE-2026-7568

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 14 May 2026 09:00:00 +0200

alt-php80 (8.0.30-43) stable; urgency=medium

  * ALTPHP-2411: per-domain CageFS isolation support in lsphp (LSAPI sapi)

 -- Sergey Fokin <sfokin@cloudlinux.com>  Sat, 03 May 2026 12:00:00 +0000

alt-php80 (8.0.30-42) stable; urgency=medium

  * ALTPHP-2310: enable sodium extension build for Debian platforms.

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Mon, 20 Apr 2026 12:00:00 +0400

alt-php80 (8.0.30-41) stable; urgency=medium

  * Add Ubuntu 26.04 (Resolute) debian build support

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Wed, 15 Apr 2026 00:00:00 +0000

alt-php80 (8.0.30-39) stable; urgency=medium

  * ALTPHP-2289: Update LiteSpeed SAPI to version 8.3

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 02 Apr 2026 00:35:43 +0400

alt-php80 (8.0.30-38) stable; urgency=medium

  * Update php-fpm patch to v4 for per-domain resource isolation support

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 17 Mar 2026 00:00:00 +0000

alt-php80 (8.0.30-36) stable; urgency=medium

  * ALTPHP-2341: Update php-fpm lve patch to extract doc_root from
    php_admin_values for CageFS per-domain isolation

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Mon, 23 Feb 2026 00:00:00 +0000

alt-php80 (8.0.30-34.1) stable; urgency=medium

  * ALTPHP-2312: fix hardcoded x86_64 OpenSSL lib path in debian/rules
    for arm64 support

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 12 Feb 2026 14:00:00 +0400

alt-php80 (8.0.30-34) stable; urgency=medium

  * EA4D-739: Make FPM config compatible with CPanel

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 28 Jan 2026 17:00:00 +0200

alt-php80 (8.0.30-33) stable; urgency=medium

  * ALTPHP-2277: add lve support for fpm handler

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 21 Jan 2026 10:35:00 +0100

alt-php80 (8.0.30-32.2) stable; urgency=medium

  * Security fixes
    - CVE-2025-14178: fix integer overflow in array_merge

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 08 Jan 2026 10:36:00 +0100

alt-php80 (8.0.30-32.1) stable; urgency=medium

  * change displayname plesk handlers to "X.Y.Z (Secured)"

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 05 Nov 2025 21:06:00 +0100

alt-php80 (8.0.30-32) stable; urgency=medium

  * ALTPHP-2216: change displayname for plesk's handlers

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 31 Oct 2025 10:43:00 +0100

alt-php80 (8.0.30-31.1) stable; urgency=medium

  * ALTPHP-2183: Build for Debian 13

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Thu, 16 Oct 2025 07:29:28 +0300

alt-php80 (8.0.30-31) stable; urgency=medium

  * ALTPHP-2172: Remove duplicated lines in php-fpm.conf

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 23 Sep 2025 17:00:00 +0200

alt-php80 (8.0.30-30) stable; urgency=medium

  * ALTPHP-2135: Enable PCRE JIT by default

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 19 Sep 2025 15:00:00 +0200

alt-php80 (8.0.30-29) stable; urgency=medium

  * ALTPHP-2168: Add includes to php-fpm.conf
  * ALTPHP-2168: Make the paths in php-fpm.conf and logrotate even

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 15 Sep 2025 20:00:00 +0200

alt-php80 (8.0.30-28) stable; urgency=medium

  * ALTPHP-2150: Support mod_php on Debian-based systems

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 03 Sep 2025 15:20:00 +0200

alt-php80 (8.0.30-27) stable; urgency=medium

  * ALTPHP-2132: update plesk's handler conf file
  * ALTPHP-2131: leave only one php.fpm config
  * EA4D-687: set error_log env in php.ini
  * ALTPHP-2080: Refactor debian spec

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 03 Sep 2025 14:35:00 +0200

alt-php80 (8.0.30-26.1) stable; urgency=medium

  * ALTPHP-2143: Fix mysql socket path

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 19 Aug 2025 20:00:00 +0200

alt-php80 (8.0.30-26) stable; urgency=medium

  * ALTPHP-2080: Use alt-curssl30 on U24 and D12

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 28 Jul 2025 17:00:00 +0200

alt-php80 (8.0.30-25) stable; urgency=medium

  * Security fixes
    - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via
      large XML namespace prefix
    - CVE-2025-1220: fix null byte termination in hostnames

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Wed, 23 Jul 2025 22:59:29 +0000

alt-php80 (8.0.30-24) stable; urgency=medium

  * ALTPHP-2049: Change method of creating php_handlers for plesk.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 22 May 2025 15:20:00 +0100

alt-php80 (8.0.30-23) stable; urgency=medium

  * Security fixes
    - CVE-2025-1217: http stream wrapper: fix handling folded headers
    - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
    - CVE-2025-1861: fix http redirect location truncation
    - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
    - fix regression in CVE-2024-11234 patch

 -- Azat Nurgaliev <anurgaliev@cloudlinux.com>  Tue, 29 Mar 2025 10:26:20 +0000

alt-php80 (8.0.30-22) stable; urgency=medium

  * Security fixes
    - CVE-2024-11235: use-after-free for ??= due to incorrect live-range
      calculation

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Fri, 11 Apr 2025 06:55:42 +0000

alt-php80 (8.0.30-21) stable; urgency=medium

    - CVE-2025-1736: verify CR during header check to prevent some misbehavior

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Fri, 04 Apr 2025 06:25:46 +0000

alt-php80 (8.0.30-20) stable; urgency=medium

  * ALTPHP-2031: write ioncube ext at the beginning of the default.ini conf

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 31 Mar 2025 17:22:00 +0200

alt-php80 (8.0.30-19) stable; urgency=medium

  * ALTPHP-1943: do not create dat file for lve if it is not cagefs
    environment

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 19 Feb 2025 15:47:00 +0100

alt-php80 (8.0.30-18) stable; urgency=medium

  * Security fixes
    - CVE-2024-8929: fix various heap buffer over-reads for mysqlnd

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Mon, 27 Jan 2025 15:27:34 +0000

alt-php80 (8.0.30-17) stable; urgency=medium

  * Security fixes
    - CVE-2024-11234: fix HTTP fulluri CRLF injection
    - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
    - CVE-2024-11233: fix single byte overread with convert.quoted-printable-
      decode filter

 -- Lizi Ekseulidze <lekseulidze@cloudlinux.com>  Mon, 13 Jan 2025 10:02:15 +0000

alt-php80 (8.0.30-16) stable; urgency=medium

  * EA4D-577: rebuild with alt-curlssl for all deb platforms

 -- Sergey Fokin <sfokin@cloudlinux.com>  Thu, 07 Nov 2024 17:39:00 +0100

alt-php80 (8.0.30-15) stable; urgency=medium

  * Security fixes
    - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-
      data boundaries larger than the read buffer
    - CVE-2024-9026: Fix possible altering of children logs
    - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Sat, 12 Oct 2024 06:40:20 +0000

alt-php80 (8.0.30-14) stable; urgency=medium

  * ALTPHP-1839: Change lsapi naming

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 23 Sep 2024 13:00:00 +0100

alt-php80 (8.0.30-12) stable; urgency=medium

  * Fix for hardened PHP
    - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full
      check is performed

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Fri, 09 Aug 2024 11:33:55 +0000

alt-php80 (8.0.30-11) stable; urgency=medium

  * Actually apply php-8.0-CVE-2024-3096.patch and php-8.0-CVE-2024-2756.patch

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Wed, 31 Jul 2024 14:00:43 +0300

alt-php80 (8.0.30-10) stable; urgency=medium

  * ALTPHP-1784: add selinux attribut httpd_exec_t to php-fpm bin

 -- Sergey Fokin <sfokin@cloudlinux.com>  Thu, 18 Jul 2024 10:43:00 +0200

alt-php80 (8.0.30-9.2) stable; urgency=medium

  * ALTPHP-1776: fpm should be installed with cli package.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 21 Jun 2024 15:20:00 +0100

alt-php80 (8.0.30-9.1) stable; urgency=medium

  * ALTPHP-1764: Bumped release

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 23 May 2024 13:32:00 +0200

alt-php80 (8.0.30-9) stable; urgency=medium

  * ALTPHP-1738: Always build with alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 15 May 2024 20:32:00 +0200

alt-php80 (8.0.30-6) stable; urgency=medium

  * Fix for hardened PHP
    - CVE-2024-3096: Disallow null character in bcrypt password to fix bug
      causing password_verify to erroneously return true
    - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
      CVE-2022-31629 fix

 -- Dmitriy Popov <dpopov@cloudlinux.com>  Fri, 10 May 2024 00:46:32 +0000

alt-php80 (8.0.30-5) stable; urgency=medium

  * ALTPHP-1730: don't create /opt/alt/alt_php.status for alt-php-internal

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 15 Apr 2024 16:36:00 +0200

alt-php80 (8.0.30-4) stable; urgency=medium

  * ALTPHP-855: set for mysql exts default path to /var/lib/mysql/mysql.sock

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 13 Mar 2024 16:26:00 +0100

alt-php80 (8.0.30-3) stable; urgency=medium

  * ALTPHP-1665: pack fpm as sub-package

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 16 Feb 2024 16:01:00 +0100

alt-php80 (8.0.30-2.2) stable; urgency=medium

  * ALTPHP-1541: Enable cache_phpdata calling after package installation on debian systems.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Tue, 26 Sep 2023 15:20:00 +0100

alt-php80 (8.0.30-2.1) stable; urgency=medium

  * Fix path for sed

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 19 Sep 2023 12:14:00 +0200

alt-php80 (8.0.30-2) stable; urgency=medium

  * ALTPHP-1542: Apply linksafe group to alt-php80 files

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 24 Aug 2023 14:20:00 +0200

alt-php80 (8.0.30-1) stable; urgency=medium

  * update to 8.0.30

 -- Sergey Fokin <sfokin@cloudlinux.com>  Sun, 06 Aug 2023 19:46:00 +0200

alt-php80 (8.0.29-1) stable; urgency=medium

  * update to 8.0.29

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 14 Jun 2023 11:32:00 +0100

alt-php80 (8.0.28-1) stable; urgency=medium

  * update to 8.0.28

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 15 Feb 2023 09:59:00 +0100

alt-php80 (8.0.27-1) stable; urgency=medium

  * update to 8.0.27

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 11 Jan 2023 10:38:00 +0100

alt-php80 (8.0.26-2) stable; urgency=medium

  * Fix for debian

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Tue, 13 Dec 2022 20:32:00 +0200

alt-php80 (8.0.26-1) stable; urgency=medium

  * update to 8.0.26 version
  * update litespeed to 8.1

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 23 Nov 2022 20:50:00 +0100

alt-php80 (8.0.25-1) stable; urgency=medium

  * update to 8.0.25 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 28 Oct 2022 12:49:00 +0200

alt-php80 (8.0.24-2) stable; urgency=medium

  * ALTPHP-1351: Added openssl-package for alt-php-internal

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 27 Oct 2022 14:20:00 +0200

alt-php80 (8.0.24-1) stable; urgency=medium

  * update to 8.0.24 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Thu, 29 Sep 2022 15:24:00 +0200

alt-php80 (8.0.23-1) stable; urgency=medium

  * update to 8.0.23 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Thu, 01 Sep 2022 16:06:00 +0200

alt-php80 (8.0.22-2) stable; urgency=medium

  * ALTPHP-1300: Build alt-php-internal for Ubuntu 22

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 11 Aug 2022 16:20:42 -0400

alt-php80 (8.0.22-1) stable; urgency=medium

  * Update to 8.0.22 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 10 Aug 2022 16:04:00 +0200

php (8.0.21-1) stable; urgency=medium

  * Update to 8.0.21 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 05 Jul 2022 06:42:28 -0400

php (8.0.20-1) stable; urgency=medium

  * Update to 8.0.20 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 07 Jun 2022 22:40:49 -0400

php (8.0.19-2) stable; urgency=medium

  * ALTPHP-1271: Added leveldb package.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 02 Jun 2022 04:20:37 -0400

php (8.0.19-1) stable; urgency=medium

  * Update to 8.0.19 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 10 May 2022 04:40:37 -0400

php (8.0.18-1.1) stable; urgency=medium

  * ALTPHP-1278: simulate RHEL SCL
  * add /opt/alt/php80/link

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 20 Apr 2022 20:58:00 +0200

php (8.0.18-1) stable; urgency=medium

  * Update to 8.0.18 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 13 Apr 2022 00:40:34 -0400

php (8.0.17-2) stable; urgency=medium

  * ALTPHP-1267: rebuild with built-in sqilte extension
  * ALTPHP-1262: fix pre/post scripts
  * ALTPHP-1276: Added --wait-lock to cagefsctl calling
  * ALTPHP-1277: skip failing of selectorctl in prostrm script

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 05 Apr 2022 16:55:00 +0200

php (8.0.17-1) stable; urgency=medium

  * update to 8.0.17

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 16 Mar 2022 12:58:00 +0100

php (8.0.16-2) stable; urgency=medium

  * ALTPHP-1266: update litespeed to 8.0.1

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 07 Mar 2022 15:11:00 +0100

php (8.0.16-1) stable; urgency=medium

  * Update to 8.0.16 version

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 16 Feb 2022 10:40:00 +0100

php (8.0.15-1) stable; urgency=medium

  * Update to 8.0.15 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 18 Jan 2022 08:40:37 -0500

php (8.0.14-2) stable; urgency=medium

  * add alt-php-config dependency

 -- Anatholy Scryabin <ascryabin@cloudlinux.com>  Mon, 27 Dec 2021 17:32:21 +0300

php (8.0.14-1) stable; urgency=medium

  * Update to 8.0.14 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 15 Dec 2021 22:40:30 -0500

php (8.0.13-1) stable; urgency=medium

  * Update to 8.0.13 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 16 Nov 2021 16:41:05 -0500

php (8.0.12-1) stable; urgency=medium

  * Update to 8.0.12 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 19 Oct 2021 08:40:40 -0400

php (8.0.11-2) stable; urgency=medium

  * Initial build

 -- Anatholy Scryabin <ascryabin@cloudlinux.com>  Mon, 27 Sep 2021 18:36:20 +0300
