🔴 Live TV: php freebsd archived - Info Live Streaming 2026

Hello good folks. This month I decided to give FreeBSD a try and see if can use it as my blog hosting server. As part of learning, I’m writing this article on how to install PHP 7.2 on FreeBSD 12.x. That was December 2018: PHP 7.2 reached end of life on 30 November 2020, FreeBSD removed the php72 port a month later, and FreeBSD 12 lost security support on 31 December 2023.

Original content from computingforgeeks.com - post 5139

For PHP 7.3, use: How to Install PHP 7.3 on FreeBSD 12, which is in the same position today. This page was checked again in October 2026 against PHP’s end of life table, the FreeBSD ports history and the PHP2Shell advisory, but the install steps below were not re-run, because the php72 packages they install no longer exist.

FreeBSD is a free and open-source Unix-like operating system which provides some good features such as preemptive multitasking, memory protection, virtual memory, support for jails, multi-user facilities, SMP support, Extensive security features e.t.c.

PHP2Shell on a PHP 7.2 FreeBSD 12 server: there is no fix to install

PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution bugs in PHP itself. The PHP project fixed them on 21 October 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and its security advisory says 8.1 and older no longer get updates. PHP 7.2 is years past that line, the lang/php72 port was deleted on 31 December 2020, and FreeBSD 12 is unsupported, so no package, port or base update will patch a PHP 7.2 server on FreeBSD 12.

The way out is a new server, not an update, because there is nothing left to update to on this stack. Install FreeBSD 14 or 15, put a supported PHP branch on it with our guide to installing PHP on a current FreeBSD release, and move the application across. Code written for 7.2 usually needs changes for PHP 8, so we would test it on a staging copy first and only switch traffic once the application runs clean there. After installing, run pkg audit -F: it must report nothing for your php8x package, because the FreeBSD 14 package branches can lag a day or two behind a PHP release.

On the old box, php -v tells you the branch, and any 7.2.x build is affected. pkg audit -F fetches the current FreeBSD vulnerability database (VuXML) and checks your installed packages against it:

php -v
sudo pkg audit -F

That audit will not warn you about PHP2Shell on this branch, because in practice VuXML only lists ports still in the tree, and the PHP2Shell entry covers the currently supported php8x ports with no php72, php73 or php80 range. We showed this on a FreeBSD 14 lab VM in October 2026 by asking the database about the 7.2.10 build this guide installed and the last 7.2.34 build:

sudo pkg audit -F php72-7.2.10 php72-7.2.34

Only two old bugs come back for 7.2.10, and nothing at all for 7.2.34, although both builds are exposed to PHP2Shell.

vulnxml file up-to-date
php72-7.2.10 is vulnerable:
  php72 -- use of freed hash key
  CVE: CVE-2020-7068
  WWW: https://vuxml.FreeBSD.org/freebsd/ee261034-b95e-4479-b947-08b0877e029f.html

  php -- env_path_info underflow in fpm_main.c can lead to RCE
  CVE: CVE-2019-11043
  WWW: https://vuxml.FreeBSD.org/freebsd/6a7c2ab0-00dd-11ea-83ce-705a0f828759.html

2 problem(s) in 1 package(s) found.

Trust the version from php -v here, and keep pkg audit for the rest of the system. While the migration is pending, PHP’s advisory lists measures that cut exposure. They are not a fix:

Set php_admin_value[memory_limit] = -1 in the PHP-FPM pool so applications can’t put a limit back, and watch memory, because one request can now use all of it.
Turn off session.upload_progress.enabled in php.ini or the pool (php_admin_flag[session.upload_progress.enabled] = off), not with ini_set(), then restart every PHP worker.
Lower post_max_size to 8M on sites without uploads, or 32M where uploads are needed, and keep upload_max_filesize under it.

On a mod_php server the same stopgaps go into the Apache configuration, where applications cannot override them. Create a small include file for them:

vim /usr/local/etc/apache24/Includes/php2shell.conf

Add these three lines, which are interim measures and not a fix:

php_admin_value memory_limit -1
php_admin_flag session.upload_progress.enabled off
php_admin_value post_max_size 8M

Restart Apache so every worker picks them up.

service apache24 restart

Confirm those values on a page served through the web server, since the CLI reads its own settings and can show a different answer. The rest of this page is our original 2018 walkthrough, kept so you can recognise what an old server has on it.

Step 1: Update ports tree

Start by updating your FreeBSD server Ports tree using the portsnap command. Note that portsnap was removed in FreeBSD 14.0; current releases fetch the ports tree with git (pkg install git, then git clone https://git.FreeBSD.org/ports.git /usr/ports), and a current tree has no lang/php72 directory.

sudo su -
portsnap fetch update

On a fresh FreeBSD 12 box in December 2018 our first run ended by asking for an extract, because /usr/ports had not been created by portsnap yet.

Looking up portsnap.FreeBSD.org mirrors... 5 mirrors found.
Fetching public key from ec2-ap-southeast-2.portsnap.freebsd.org... done.
Fetching snapshot tag from ec2-ap-southeast-2.portsnap.freebsd.org... done.
Fetching snapshot metadata... done.
Fetching snapshot generated at Sun Dec  9 00:19:28 UTC 2018:
Extracting snapshot... done.
Verifying snapshot integrity... done.
Fetching snapshot tag from ec2-ap-southeast-2.portsnap.freebsd.org... done.
Fetching snapshot metadata... done.
Updating from Sun Dec  9 00:19:28 UTC 2018 to Sun Dec  9 19:15:19 UTC 2018.
Fetching 5 metadata patches... done.
Applying metadata patches... done.
Fetching 0 metadata files... done.
Fetching 78 patches.
(78/78) 100.00%  done.
done.
Applying patches...
done.
Fetching 3 new ports or files... done.
/usr/ports was not created by portsnap.
You must run 'portsnap extract' before running 'portsnap update'.

When running Portsnap for the first time, you need to extract the snapshot into /usr/ports:

portsnap extract

You should get the message below at the end of the output.

Building new INDEX files... done.

Confirm that everything is up to date.

portsnap fetch update

A second run finds nothing new, so the tree is in sync with the snapshot we just extracted.

Looking up portsnap.FreeBSD.org mirrors... 5 mirrors found.
Fetching snapshot tag from ec2-eu-west-1.portsnap.freebsd.org... done.
Latest snapshot on server matches what we already have.
No updates needed.
Ports tree is already up to date.

By default, the Ports Collection itself is stored as a subdirectory of /usr/ports.

Step 2: Install PHP 7.2 on FreeBSD

There are two ways you can install PHP 7.2 on FreeBSD. Neither works on a server today: pkg finds no php72 package and the ports tree has nothing to build since the port was removed.

Install from Binary packages
Install from source using ports

Method 1: Install PHP 7.2 on FreeBSD from binary

Download and install pkg if not already done:

/usr/sbin/pkg

Answer y when it offers to bootstrap pkg, and it fetches and installs the package manager for your release before returning to the prompt.

Then install PHP 7.2

pkg install php72

Back then pkg resolved three packages for us.

Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 3 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	php72: 7.2.10
	libargon2: 20171227_1
	pcre: 8.42

Number of packages to be installed: 3

The process will require 31 MiB more space.
5 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/3] Fetching php72-7.2.10.txz: 100%    3 MiB 192.9kB/s    00:18
[2/3] Fetching libargon2-20171227_1.txz: 100%   64 KiB  65.3kB/s    00:01
[3/3] Fetching pcre-8.42.txz: 100%    1 MiB  44.9kB/s    00:28
Checking integrity... done (0 conflicting)
[1/3] Installing libargon2-20171227_1...
[1/3] Extracting libargon2-20171227_1: 100%
[2/3] Installing pcre-8.42...
[2/3] Extracting pcre-8.42: 100%
[3/3] Installing php72-7.2.10...
[3/3] Extracting php72-7.2.10: 100%

Confirm PHP version installed.

php -v

The 2018 build printed 7.2.10. PHP2Shell affects it like every other 7.2 release, so on a server you still run this line is the warning sign, not a success message.

PHP 7.2.10 (cli) (built: Dec  1 2018 01:31:03) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies

With the CLI in place, add the extensions your applications need.

Install PHP 7.2 Extensions on FreeBSD

Extensions can be installed using syntax php72-<extension>. See example below which installs standard extensions.

pkg install php72-curl php72-extensions php72-json php72-xml \
php72-zip php72-intl php72-mysqli php72-pdo_mysql php72-pdo \
php72-pear php72-soap php72-phar

You can view loaded modules with:

php -m

The other route was building from the ports tree.

Method 2: Install PHP 7.2 on FreeBSD from ports

Change your working directory to PHP 7.2 ports folder

cd /usr/ports/lang/php72

Then build and install PHP 7.2

make install clean

To install PHP 7.2 extensions on FreeBSD, do it like below:

cd /usr/ports/lang/php72-extensions/
make install clean

That’s all. You now have PHP 7.2 installed on your FreeBSD server. If that server is still running, plan its replacement using the PHP2Shell section near the top of this page.

How To Install PHP 7.2 on FreeBSD 12