Bug#1114729: apache2 delivers .php files uninterpreted in clear during apt dist-upgrade

--v3kxHEo2rjyYrQSS
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

* David Pr=C3=A9vot [Mon Jan 19, 2026 at 03:57:46PM +0100]:
> Le Sat, Dec 13, 2025 at 08:54:04AM +0100, Sebastiaan Couwenberg a =C3=A9c=
rit :
> > On Fri, 26 Sep 2025 09:03:19 +0200 Moritz Schlarb <[email protected]>=
 wrote:
> > > Philipp G=C3=BChring wrote:

> > > > During the run of apt dist-upgrade, apache suddenly delivered the .=
php files uninterpreted in cleartext to the clients, revealing any secrets,=
 database connection strings, passwords, API keys, ... to the user requesti=
ng the page.
> > > > After apt dist-upgrade was complete, apache correctly interpreted t=
he .php files again

> > > please tell us how exactly are you running the PHP interpreter in you=
r apache
> > > (mod_php or PHP-FPM or...)?

FTR: not being the original bug reporter, but I tried to reproduce
the behavior, but wasn't able to do so. This might indeed be
configuration/setup specific?

> > I've noticed the same with upgrades of systems at $DAYJOB where libapac=
he2-mod-php8.4 did not get enabled automatically after the upgrade of libap=
ache2-mod-php.
> >
> > The upgrade procedure for those systems added steps to explicitly enabl=
e it:
> >
> >  a2enmod php8.4
> >  service apache2 restart
>
> Thanks for the feedback. The initial bug report also seem to imply that
> the issue happens =E2=80=9CDuring the run of apt dist-upgrade=E2=80=9D, i=
=2Ee., during a
> major upgrade. Maybe this issue should rather be documented in the
> release notes actually, and it may not be specific to PHP either.

This feels like a *different* bug report than the original bug
report (the one from Philipp)?

I tried to reproduce also the issue from Sebastiaan, but couldn't -
it seems to be working as expected for the bookworm->trixie upgrade
situation (as long as libapache2-mod-php is/was present on bookworm,
and not only libapache2-mod-php8.2 was explicitly installed, because
then libapache2-mod-php8.4 would be missing on trixie of course).

Situation on bookworm:

  root@f4e23b69b69f:/# ls -la /etc/apache2/mods-enabled/php*
  lrwxrwxrwx 1 root root 29 Jul 18 20:10 /etc/apache2/mods-enabled/php8.2.c=
onf -> ../mods-available/php8.2.conf
  lrwxrwxrwx 1 root root 29 Jul 18 20:10 /etc/apache2/mods-enabled/php8.2.l=
oad -> ../mods-available/php8.2.load

After the upgrade to trixie:

  root@1f7465dbdcb4:/# ls -la /etc/apache2/mods-enabled/php*
  lrwxrwxrwx 1 root root 29 Jul 18 20:20 /etc/apache2/mods-enabled/php8.4.c=
onf -> ../mods-available/php8.4.conf
  lrwxrwxrwx 1 root root 29 Jul 18 20:20 /etc/apache2/mods-enabled/php8.4.l=
oad -> ../mods-available/php8.4.load

I'm wondering whether any *further* php version might also have been
present (like the ones thankfully being provided at
https://deb.sury.org/) before the upgrade to trixie?

FTR, my STR:

  podman run --pull=3Dalways --rm -i -t -v $(pwd)/:/code:rw debian:bookworm=
 bash
    apt update ; apt -y install apache2 libapache2-mod-php
    sed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/debian.sources
    apt update
    apt -y dist-upgrade

regards
-mika-

--v3kxHEo2rjyYrQSS
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEM8yxNkAa/shDo4djlqh4crfqNzcFAmpb6VUACgkQlqh4crfq
Nze2AQ/+KtgkGIBO4vJr1KwnN3ayhbz9uoYrzUHyYOeT6tosikF2T0Y/1u4/28kU
np1wBB6waLsLLeaacHfHnzFVf8Hu17kKHX3uQI8GC02LenrjwYPPv6mFJkgu1OCw
mFfs2sRc/8szJh/AV65gxgsWl6puw3pyh0cCbaeY6NKsdAtJRZDEKqlfK8uwu1nF
6F5UvpqBsaYbkExy9unIZMyT52Lrlq+uDGmI0iPZmcvzZriicSLldGQoXf5EKI4c
Azo5QizUxQ0u1iOUpu5zwcRw2yFSF6BDWy08Ld8z9pke4vmRN1x7yy5K+YptwzKS
JflE3/gNC4eqg4u8MrWzIGDlXWYcFphl6Vw5d+d0Xq98pKUhsD6s8XmcRde0+iuu
OOJ0cic4qf36+4x1yDWjkhPdb69flAw91vd1uFjklaNH5PmYQbkbIk8MQsP2vPqj
tYRUQz0Uyd4Qk7t7xQjTQKLsc+jbW97ujrQfU8F8EIZ8r8jegM9KIhVLCLvhL0LP
C6x0PUopvilIn/XsHL8JUUjSV4xETVMyurEKH6uktaN5r87sRBUmTPAsdXfI/T7Y
QFxvmS06gg/uzf0yZAuPwW/kMlU7W5z4yTfHiKjRPhGBARsseLS8czx0++Cqe1+Y
6/5kfruak1LS4wLQCXcv8x1aTrUPdKms/k34wB9yBk2bk+egt6E=
=Dut1
-----END PGP SIGNATURE-----

--v3kxHEo2rjyYrQSS--