Happy PHPocalypse for those who celebrate.

We're sure you've heard about the PHP2SHELL exploit that was patched today. If not, you can read a little about it here, but suffice to say it's BAD. Like, really really bad.

Cringey millennial meme

Absolutely EVERYONE is encouraged to upgrade their version of PHP ASAFP

Our hosted fleet is fully patched, so those of you nestled in our loving arms are already good to go with nothing for you to do. This release fixes just a few small bugs, but it really a convenience release so that folks on docker can get a real tagged version instead of using latest.

Docker Users

We don’t pin the patch versions in the docker images, so a rebuild will get whatever is latest for the distro.

Ubuntu back-patches their packages and then gives them a sub version (the 24.0.13) version, for example:

apt list --installed | grep php

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

libapache2-mod-php8.3/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php-common/now 2:93ubuntu2 all [installed,local]
php-memcached/now 3.2.0+2.2.0-4ubuntu3 amd64 [installed,local]
php8.3-bcmath/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-cli/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-common/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-curl/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-dev/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-gd/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-igbinary/now 3.2.13-1ubuntu3 amd64 [installed,local]
php8.3-ldap/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-mbstring/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-memcached/now 3.2.0+2.2.0-4ubuntu3 amd64 [installed,local]
php8.3-msgpack/now 1:2.2.0~rc2-3ubuntu1 amd64 [installed,local]
php8.3-mysql/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-opcache/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-readline/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-redis/now 5.3.7+4.3.0-3ubuntu1 amd64 [installed,local]
php8.3-xml/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]
php8.3-zip/now 8.3.6-0ubuntu0.24.04.13 amd64 [installed,local]

Similarly, Alpine has back-patched for this security vulnerability.

Check inside the running container, replacing snipe-it with the container name:

docker exec snipe-it php -v

To see the full Alpine package versions:

docker exec snipe-it sh -c 'apk info -v | grep -E "^php[0-9]+-"'

After updating, recreate the container so its web-serving PHP processes use the updated binaries.

What's Changed

• Fixed #19870 and #19869 - small maintenance improvements by @snipe in #19871
• Fixed #19595 - numbers in custom fields exporting inconsistently by @snipe in #19872
• 🎥 Fixed #19778 - allow bulk scanner auditing by 2D bardcode by @snipe in #19874
• Fixed #19626 - respect lastname firstname order more thoroughly by @snipe in #19875
• Fixed potentially missing rows in license seats api endpoint by @marcusmoore in #19883
• Bulk Checkout: Fixes redirect option not persisting by @Godmartinz in #19881
• Fixed #19887 - use alpine 3.24 to get newer php by @markof88 in #19889
• Fixed #18508 Custom Fields: Allow cloning custom fieldsets by @marcusmoore in #19793

Full Changelog: v8.8.1...v8.8.2