Conversation

Here’s a good laugh. When I run ‘PHP -v’ on my newly upgraded Ubuntu server, the one with PHP 8.3.6 installed, it tells me the build date is “Oct 19 2026 15:16:58”. How’s that for a swing and a miss?

RE: https://infosec.exchange/@Spartan_1986/117480764972910966

So, that build date got me thinking. What if Canonical did implement the fix, but they are not reporting all the build digits? I know. That's stupid. But fortunately I can check on that. I've a Pro account and the server is, of course, registered with the Pro binary installed. You can force any CVE update with a the command "sudo pro fix CVE-YYYY-XXXX". So I ran the command for the two CVEs involved with this vuln. Here's what I got:

*******************************
$ sudo pro fix CVE-2026-109618
CVE-2026-109618: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109618

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109618 is resolved.
$ sudo pro fix CVE-2026-109619
CVE-2026-109619: PHP vulnerabilities
- https://ubuntu.com/security/CVE-2026-109619

1 affected source package is installed: php8.3
(1/1) php8.3:
A fix is available in Ubuntu standard updates.
The update is already installed.

✔ CVE-2026-109619 is resolved.
*******************************

Damn it Canonical! Digits f-ing matter!!! Why do you have to be so stupid. I frankly don't even know if I can trust this. It should report the correct version with 'php -v' you numbskulls. This is why I got out of system administration in the first place.