[CLSA-2026:1788343283] Fix of 32 CVEs
Type:
security
Severity:
Critical
Release date:
2026-09-02 10:02:13 UTC
Description:
* ALTPHP-2571: restore the sticky-writable mode on /opt/alt/php72/var/lib/php/session from the Debian/Ubuntu postinst - dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root user could write session data * ALTEAPLN-3: no change to the Debian packaging - alt-php72-cli has never depended on the FPM package here. Recorded for parity with the RPM side, where a hard Requires was dropped so the FPM package can be removed on servers that only use PHP Selector via lsapi * ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php72/root/etc/php-fpm.d/_.conf placeholder in the package. cPanel counts any *.conf in that directory as an enabled FPM pool and kept restarting alt-php72-fpm through chkservd on servers that never use FPM, even with the unit disabled. The alt-php72-php-fpm post-install script now creates the file with mode 0644 only when cPanel is absent - the only case where it is wanted, to silence php-fpm's include-glob warning - and deletes it when cPanel is present. Since no package owns the file any more, a new -php-fpm postrm removes it on remove and purge, so a stray *.conf cannot be left behind to re-trigger this bug if cPanel is installed later The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel * ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since 7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master with SIGUSR2 and leave the service down * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
Updated packages:
  • alt-php72_7.2.34-91_amd64.deb
    sha:a1a6461b9521f209c61f8316ae2895721fa3e665
  • alt-php72-bcmath_7.2.34-91_amd64.deb
    sha:7929d96601cba1eb2d79e796e31882af1fea58b5
  • alt-php72-cli_7.2.34-91_amd64.deb
    sha:9fadd34075d19bef7a976193853dd9b9ece477d9
  • alt-php72-common_7.2.34-91_amd64.deb
    sha:10916dc341a7447c1d73fdc40d4f0fceccf583a6
  • alt-php72-dba_7.2.34-91_amd64.deb
    sha:afd2aea1aa30703f110c75b41132917c18dcae38
  • alt-php72-dev_7.2.34-91_amd64.deb
    sha:76626632b46be977430741ded93faaec4ef2d23f
  • alt-php72-enchant_7.2.34-91_amd64.deb
    sha:14c95b30b22c95eef4cd3b0904e49b0377c921d0
  • alt-php72-firebird_7.2.34-91_amd64.deb
    sha:4700c294a1a0c2b61fbe89bb1943d03b7b971961
  • alt-php72-gd_7.2.34-91_amd64.deb
    sha:ca56fe9b11eb39623c466113585f91f9c3097613
  • alt-php72-imap_7.2.34-91_amd64.deb
    sha:a1ee4fd40b0bb651d5e3f8b3fc80c1ee2be2f55c
  • alt-php72-intl_7.2.34-91_amd64.deb
    sha:38906481c2b1fffaba2ebfdfcc6bfc4b42cbcebe
  • alt-php72-ldap_7.2.34-91_amd64.deb
    sha:b2ffe491db230e5538d0da3925d6c4df2df7712c
  • alt-php72-mbstring_7.2.34-91_amd64.deb
    sha:6a093ba414c031ef34cfe257fde60f33102491ef
  • alt-php72-mysqlnd_7.2.34-91_amd64.deb
    sha:7d3b382f53aa12d2de2632dbc6524d30b4c03ab8
  • alt-php72-odbc_7.2.34-91_amd64.deb
    sha:6e4776bb85622b2893e462929d56e12ea305a65d
  • alt-php72-opcache_7.2.34-91_amd64.deb
    sha:42832ca5adaed424946afb6b570b34f4e4f69306
  • alt-php72-pdo_7.2.34-91_amd64.deb
    sha:7a264ac086e06226713e82ba464b54efed24cd3a
  • alt-php72-pgsql_7.2.34-91_amd64.deb
    sha:8027c36ef42c6cd180356cc278fb2136b8d78909
  • alt-php72-php-fpm_7.2.34-91_amd64.deb
    sha:ddef2e025a31c4b11f3e726bce2cd503efce7cd9
  • alt-php72-process_7.2.34-91_amd64.deb
    sha:ce6671b002be92a052e0146ba2216033c3507315
  • alt-php72-pspell_7.2.34-91_amd64.deb
    sha:95966fe94d084c1fb86fb15ac38ac2cf9cd712a0
  • alt-php72-recode_7.2.34-91_amd64.deb
    sha:2746ced6d300d0f5bfe7c4814ddcb2721ae8a95e
  • alt-php72-snmp_7.2.34-91_amd64.deb
    sha:f0de886f3e430346bf927673275021de9a43bf0c
  • alt-php72-soap_7.2.34-91_amd64.deb
    sha:deb74cdfe14ae146e6839ed14b4df0017c2e1116
  • alt-php72-sodium_7.2.34-91_amd64.deb
    sha:7d1ae7f3fe450fa07c1a90c151b8453f46e01b06
  • alt-php72-tidy_7.2.34-91_amd64.deb
    sha:d44803e8353d199603f0f3de4b7bc12f145717ab
  • alt-php72-xml_7.2.34-91_amd64.deb
    sha:3cb486142807ef90e7937e2d6841d9077e26e040
  • alt-php72-xmlrpc_7.2.34-91_amd64.deb
    sha:ff2097ccdff56629efd26a41918bf9491cfed4bc
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.