php2shell on arm64: Building Fixed PHP Packages Without Poudriere

Table of Contents Table of Contents Why Not Just Use Poudriere? The Build Jail A Ports Tree on the Right Branch Which Ports, Which Options? Building the Packages The Mistake: Where Did My Packages Go? A Local Repository Upgrading the Target Jails Surprise Guests in the Second Jail Switching Back to Official Packages Pitfalls: The Checklist Conclusion References On 2026-10-21 the PHP project released fixes for two critical vulnerabilities nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2). Every PHP version since PHP 5 is affected. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. My jail host runs FreeBSD 15.1 on arm64, and three of its Bastille jails run PHP: a looking glass for my network, a DokuWiki and a Nextcloud. I stopped all three the same day and disabled their autostart. The plan was to wait for the fixed packages. The FreeBSD side was quick. lang/php85 was updated to 8.5.12 in the ports tree within a day, in main as well as in the 2026Q4…