Hi Stuart, I noticed the recent PHP2Shell security advisories affecting PHP, and I'm trying to establish the status of the OpenBSD packages.
I'm running OpenBSD 8.0 with the official PHP 8.4.26 package. I have updated all packages, but no newer PHP 8.4 package is currently being offered. The package mirrors already contain PHP 8.5.11, but I understand that switching PHP branches is not an appropriate substitute for a security fix. Could you clarify whether the OpenBSD PHP packages are affected by these vulnerabilities, and whether a patched 8.4 package is being prepared? I couldn't find a relevant discussion on [email protected], so I thought I'd ask you directly. Thanks for your work on the ports. Best regards
