Secunia.com: Ubuntu Update for PHP
679178
In this new advisory posted on the Secunia.com site today, there's an announcement of a highly critical update for Ubuntu users for their PHP distributions.   Ubuntu has issued an update for php. This fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions and potentially by malicious people to compromise a vulnerable system.   Check out the posting to grab the links for the packages for the various distributions (and for the different version numbers of Ubuntu). As this issue is marked as "highly critical" it's recommended that you update your installation as soon as possible.
71505
Latest PHPClasses.org Releases:CAPTCHA 2Get Futurist DatePictoru's GIF TextFormulariosIP_to_countryMsSql To XMLrschatCheck spamTSfloCrosswordPictoru's GIF TextMYSQLCLS_DBFile2XMLColor extractphpmmPHP Array to Javascript
713722
Latest PEAR Releases:Text_Wiki_Creole 0.5.1HTML_QuickForm_Renderer_Tableless 0.5.3PHP_Archive 0.11.0pearweb_phars 1.3.1PHP_Archive 0.11.1pearweb_phars 1.3.2Validate_FI 0.3.0Structures_DataGrid_DataSource_DBQuery 0.1.10Structures_DataGrid_DataSource_MDB2 0.1.10Structures_DataGrid_DataSource_DBTable 0.1.6File 1.3.0Tree 0.3.0pearweb_index 1.0.0RC1pearweb_index 1.16.2pearweb_index 1.16.1pearweb 1.16.0pearweb_index 1.0.0HTML_QuickForm 3.2.8
289622
According to this new advisory from Secunia today, the SuSE linux group has released a new package update for the PHP4 distribution on their operating system:   SUSE has issued an update for php4. This fixes some vulnerabilities and a weakness, where one has an unknown impact and the others can be exploited by malicious, local users to gain escalated privileges, and by malicious, local users and malicious people to bypass certain security restrictions.   The issue is marked as "Less critical" but it's still a good idea to update, especially when it relates to security issues. You can find more information at the original advisory on the Novell site.
386588
Latest PHPClasses.org Releases:Smarty and MIME message integrationYour SayphpPhotoGalleryInterfacesIlariaParser 7just7.comaDB PDO like database abstractionSAMP Socket
736064
The Open SUSE group has released an update for a list of their software to bring their PHP4 and PHP5 packages up to date.   php5 was updated to version 5.2.5 to fix several security vulnerabilities. For php4 on SLES9 the patches were backported.   You can find out more about the issues corrected as well as links to the packages that have been updated in the advisory message.
371626
The Red Hat linux group has issued an update for their PHP packages today:   Red Hat has issued an update for php. This fixes some vulnerabilities, which can be exploited by malicious, local users to bypass certain security restrictions and by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service).   You can get more information about this moderate level advisory from the Red Hat advisory including the affected products and the list of packages that should be updated to bring your installation up to date.
570691
According to this new advisory on the Secunia website, rPath has updated more of their PHP packages and has marked the update as "moderately critical" to keeping your systems safe.   rPath has issued an update for multiple php packages. This fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious, local users and malicious users to bypass certain security restrictions.   The original advisory has links to the updated versions and to references as to what has changed.   In its default configuration, rPath Linux 1 does not install php5 and is thus not vulnerable to these attacks; however, systems to which php5 has been added may be vulnerable to one or more of these attacks.
304159
Antony Dovgal has pointed out the updated packages that have been released to the snaps.php.net website by Derick Rethans.   He also includes a list of things that will be included in this upcoming release like:   Namespaces Late static binding Accessing static members through $foo::myFunc() Improved OpenSSL extension PCRE 7.4   Grab your copy of these latest snapshots from the snaps website and get to testing them on your system to see what happens before the release.
559035
Michael Kimsal has posted a formal prediction that a patch, created by someone in the community, will emerge making it simple to bridge the gap between PHP4 and PHP5 applications.   Given the high number of shared hosts still running PHP4, the backwards compatibility issues going from 4->5 (yes, there are some!) and the new PHP4 "end of life" date (8/8/8), someone will likely find a way to make these run together, and possibly even charge money for it.   He suggests that many hosts out there would happily pay a sum to get this kind of functionally for their customers. It would provide a solution to customers who just don't understand the force towards PHP5 and would make them (and their PHP4 applications) happier.
697974
Secunia has released an advisory for PHP today related to an issue caused by an integer overflow that could allow for bypassing of security of an application.   A weakness and a vulnerability have been reported in PHP 5, where the vulnerability has unknown impact and the weakness can be exploited by malicious, local users to bypass certain security restrictions.   The issue is caused by issues with the chunk_split and realpath functions that can lead to a bypass of the open_basedir restriction on a server.   The issue is marked as "moderately critical" and it is suggested that users update to PHP 5.2.3 to correct the issue.
222395
As reported here on Secunia (as discovered by shinnai), there's a code execution vulnerability in PHP's glob function:    The vulnerability is caused due to an error in the handling of an uninitialized structure inside the "glob()" function. This can be exploited to execute arbitrary code, which may lead to security restrictions (e.g. the "disable_functions" directive) being bypassed.   The vulnerability is confirmed in the 5.2.3 win32 installer. Other versions may also be affected.    The issue is marked as "less critical" and can be avoided easily by only allowing trusted users the correct permissions to execute PHP code on the server.
324327
Latest PEAR Releases:PHP_CompatInfo 1.4.1HTML_Progress2 2.3.0RC1pearweb_phars 1.1.0pearweb 1.4.0Auth 1.5.0HTML_QuickForm_altselect 1.0.0RC1PEAR_PackageUpdate 0.6.1PHP_Beautifier 0.1.13pearweb 1.4.2Structures_LinkedList 0.1.2pearweb 1.5.0RC1Console_Getopt 1.2.2Structures_DataGrid_Renderer_Flexy 0.1.0HTML_CSS 1.1.3Text_CAPTCHA 0.2.1PHP_CodeSniffer 0.4.0
706136
Latest PHPClasses.org Releases:PHPThreaderVery Simple CaptchaPHP ThreaderMultiCurl class libraryPersistenciaOfile classSecurity_TokenPHP poppassd clientTree AJAXClass Treeview
165658
Following up on yesterday's release of PHP 5.2.0 RC4 from Ilia, Edin Kadribasic has posted the corresponding Windows builds.   This build is featuring the new installer contributed by John Mertic so testing it before the final release would be appreciated.   He's linked to various packages:  php-5.2.0RC4-Win32.zip php-5.2.0RC4-win32-installer.msi pecl-5.2.0RC4-Win32.zip php-debug-pack-5.2.0RC4-Win32.zip
763575
Ilia Alshanetsky posts today about the proposed "Month of PHP bugs" that Stefan Esser is proposing:   It would be interesting to see what issues he discovers, hopefully most of them have already been reported to the PHP Security Team, in which case the upcoming 5.2.1 release will provide a resolution path for affected users.   Hopefully, as Ilia states, the bugs will not turn out to be zero-day vulnerabilities and will instead be smaller issues. Either way, a bug-fix patch will probably soon follow.   Either way, I have to look at this as a free security audit of PHP by someone with a clue about security and ultimately, in the long run it will only make PHP better, even if March is going to be rather busy.
535273
PHP driven Inventory, HelpDesk, Support, Issue Tracking, and Knowledge Base web application. Focuses on simplicity and ease of customization. Sort of a mini-Directory solution for SMBs using PHP and any Pear::DB supported database. OpenIT 1.3 represents a major step from 1.2.  Thanks to Aaron's (acolflesh) new "Lookups" section all entries in the database can be edited via OpenIT.  This means no more using phpMyAdmin to add Departments.   Dan (dancoulter) worked hard to get Active Directory authentication to work via LDAP.  This is an exciting feature for anyone using Active Directory.  The coding style is in a state of flux as we're trying to bring it in line with PEAR standards.  There have been minor database changes.  At this point the easiest way to upgrade your database is to do a diff of the old & new tools/setup.php scripts to see what has changed.  Please use this release as much as possible and report bugs on the SourceForge Project Bug tracker & forums.  Note:  From version 1.3 forward OpenIT will follow versioning practices similar to the Linux Kernel.  This means all odd minor number releases (1.3, 2.5, etc.) will be "Testing" releases, while even minor number releases (1.4, 2.0, etc.) will be "Stable" releases.  OpenIT 1.3 Released http://openit.sf.net  This version is availabe here: https://sourceforge.net/project/showfiles.php?group_id=111107&package_id=133178