Critical PHP vulnerabilities: how to safely patch LibreTime 4.5.0

Uncategorized
1

Hi everyone,

I’m running LibreTime 4.5.0 on a dedicated production server and would appreciate the community’s advice following the PHP security advisory published on October 21, 2026, covering CVE-2026-109618 and CVE-2026-109619.

My current setup is:

  • LibreTime: 4.5.0

  • Operating system: Debian GNU/Linux 11 — Bullseye

  • PHP: 7.4.33, with Debian package version 7.4.33-1+deb11u12 for PHP-FPM, CLI and the core extensions

  • Web server: Nginx with PHP-FPM

  • Audio streaming: Icecast2

APT currently reports no available PHP updates from my configured Debian repositories.

I’m considering switching to the Sury PHP 7.4 packages, specifically revision 7.4.33-31, whose changelog includes fixes for both vulnerabilities. The Debian 11 package identified is:

1:7.4.33-31+0~20261021.121+debian11~1.gbpe9c428

Before making this change on a live radio server, I would appreciate feedback on the following:

  1. Has anyone successfully applied this update with LibreTime 4.5.0 on Debian 11? Are there any known compatibility issues with the legacy interface or PHP extensions?

  2. Is Sury the recommended immediate patching route for this setup, or would the maintainers recommend another approach?

  3. Which services actually need to restart? Can Liquidsoap, Playout and Icecast remain running throughout the PHP update? What interruption should I expect for the web interface?

  4. Is there a tested upgrade and rollback procedure that preserves the existing PHP configuration and LibreTime FPM pool?

My main priority is to patch these vulnerabilities while keeping the radio on air. Any guidance, tested commands or experience with this specific configuration would be very helpful.

Thank you!