From dbowenrci at gmail.com Wed Oct 21 11:29:26 2026 From: dbowenrci at gmail.com (David Bowen) Date: Wed, 21 Oct 2026 14:29:26 -0400 Subject: [mapguide-users] PHP vulnerabilities Message-ID: Hi Jackie, Not sure if you've seen this yet or not, but 2 critical vulnerabilities have been identified in PHP: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php How were vulnerabilities like this resolved in the past? Thanks, David -------------- next part -------------- An HTML attachment was scrubbed... URL: From flipper at buoyshark.com Wed Oct 21 11:37:31 2026 From: flipper at buoyshark.com (Scott Hameister) Date: Wed, 21 Oct 2026 13:37:31 -0500 Subject: [mapguide-users] PHP vulnerabilities In-Reply-To: References: Message-ID: Is there an easy patch? On Wed, Oct 21, 2026, 1:29?PM David Bowen via mapguide-users < mapguide-users at lists.osgeo.org> wrote: > Hi Jackie, > > Not sure if you've seen this yet or not, but 2 critical vulnerabilities > have been identified in PHP: > https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php > > How were vulnerabilities like this resolved in the past? > > Thanks, > David > _______________________________________________ > mapguide-users mailing list > mapguide-users at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapguide-users > -------------- next part -------------- An HTML attachment was scrubbed... URL: From ari.hyvonen at gmail.com Wed Oct 21 11:45:55 2026 From: ari.hyvonen at gmail.com (=?UTF-8?B?QXJpIEh5dsO2bmVu?=) Date: Wed, 21 Oct 2026 21:45:55 +0300 Subject: [mapguide-users] PHP vulnerabilities In-Reply-To: References: Message-ID: Hello, Mapguide extensions are compiled using certain PHP version which is 8.3 for Mapguide 4. PHP can and should be updated with latest version of that series. Today's release is version 8.3.36. PHP 8.3 will receive security updates until end of 2027 and it would be important that there is new version of Mapguide compiled using PHP 8.4 or 8.5 before that. Mapguide 3.1.2 used PHP 5.6 and there was quite long time when that didn't get updates anymore. Br, Ari ke 21.10.2026 klo 21.29 David Bowen via mapguide-users < mapguide-users at lists.osgeo.org> kirjoitti: > Hi Jackie, > > Not sure if you've seen this yet or not, but 2 critical vulnerabilities > have been identified in PHP: > https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php > > How were vulnerabilities like this resolved in the past? > > Thanks, > David > _______________________________________________ > mapguide-users mailing list > mapguide-users at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapguide-users > -------------- next part -------------- An HTML attachment was scrubbed... URL: From KParker at aesi-consulting.com Wed Oct 21 11:47:31 2026 From: KParker at aesi-consulting.com (Kyle Parker) Date: Wed, 21 Oct 2026 11:47:31 -0700 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS Message-ID: <6AD908C30200007300026E83@mail.aesi-consulting.com> Good afternoon, Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP CVE-2026-109618 & CVE-2026-109619 My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you. Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments. -------------- next part -------------- An HTML attachment was scrubbed... URL: From gordon.luckett at arrowgeomatics.com Wed Oct 21 11:56:23 2026 From: gordon.luckett at arrowgeomatics.com (gordon.luckett at arrowgeomatics.com) Date: Wed, 21 Oct 2026 18:56:23 +0000 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS In-Reply-To: <6AD908C30200007300026E83@mail.aesi-consulting.com> References: <6AD908C30200007300026E83@mail.aesi-consulting.com> Message-ID: I just tested 8.3.36 without issue (so far). (just overwrite in place) https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3 On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users wrote: > Good afternoon, > > Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP > > CVE-2026-109618 & CVE-2026-109619 > > My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you. > > Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments. -------------- next part -------------- An HTML attachment was scrubbed... URL: From ari.hyvonen at gmail.com Wed Oct 21 12:13:16 2026 From: ari.hyvonen at gmail.com (=?UTF-8?B?QXJpIEh5dsO2bmVu?=) Date: Wed, 21 Oct 2026 22:13:16 +0300 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS In-Reply-To: References: <6AD908C30200007300026E83@mail.aesi-consulting.com> Message-ID: Hello, I also updated as soon as update was released. I have been updating PHP ever since I have started using Mapguide in 2011 and never had compatibility issue. Normally I update development server first and do testing there but now this was done straight to production. Make a backup of PHP folder before overwriting with new files so you can restore them if something fails. Br, Ari ke 21.10.2026 klo 22.06 GordonL via mapguide-users < mapguide-users at lists.osgeo.org> kirjoitti: > I just tested 8.3.36 without issue (so far). > (just overwrite in place) > > > https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3 > > On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users < > mapguide-users at lists.osgeo.org> wrote: > > Good afternoon, > > Is patching the PHP version bundled with MapGuide possible? There has been > a new update from php.net to address certain security vulnerabilities > with PHP > > CVE-2026-109618 & CVE-2026-109619 > > My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. > Would updating PHP to 8.3.35 be possible without issue or would it cause > problems with mapguide? Thank you. > > Confidentiality Notice: The information contained in this message and any > attachments may contain confidential or proprietary material and is > intended solely for the use of the person or entity to which it is > addressed. Any unauthorized review, use, disclosure or distribution of this > communication is strictly prohibited. If you have received this > communication in error, please immediately notify the sender by reply > e-mail and destroy all copies of this communication and any attachments. > > > _______________________________________________ > mapguide-users mailing list > mapguide-users at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapguide-users > -------------- next part -------------- An HTML attachment was scrubbed... URL: From Dan.Nilsson at tyrens.se Wed Oct 21 12:22:51 2026 From: Dan.Nilsson at tyrens.se (Dan Nilsson) Date: Wed, 21 Oct 2026 19:22:51 +0000 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS In-Reply-To: References: <6AD908C30200007300026E83@mail.aesi-consulting.com> Message-ID: Is the php call working well with 8.3.36? login.php to MapGuide Site Administrator? When I use QuickPlot I get an error. I get this error: [cid:719abc64-5999-407f-8445-c07c618c4fa5] Have I done anything wrong? I have done a php file that print out the version I have installed: 8.3.36 If I go back to the old PHP I get this: 8.3.26 And when I use login.php I get MapGuide Site Administrator as expected [cid:af47f03c-5e97-4dc2-bb17-4c8e89d4874e] Br, Dan ________________________________ Fr?n: mapguide-users f?r GordonL via mapguide-users Skickat: den 21 oktober 2026 20:56 Till: MapGuide Users Mail List Kopia: gordon.luckett at arrowgeomatics.com ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. I just tested 8.3.36 without issue (so far). (just overwrite in place) https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3 On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users wrote: Good afternoon, Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP CVE-2026-109618 & CVE-2026-109619 My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you. Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 26495 bytes Desc: image.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 10250 bytes Desc: image.png URL: From gordon.luckett at arrowgeomatics.com Wed Oct 21 12:28:53 2026 From: gordon.luckett at arrowgeomatics.com (gordon.luckett at arrowgeomatics.com) Date: Wed, 21 Oct 2026 19:28:53 +0000 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS In-Reply-To: References: <6AD908C30200007300026E83@mail.aesi-consulting.com> Message-ID: <_kEkNwAtBUeXLs_3Z5x3O3J3wYzZ9XM1jvvsZq0W0TkjZi1AxqPDRk-XqAXmqsZj7wK0PL8hna3mnNlEDoMsqeuuOtjZm61sS1TfbN2evM0=@arrowgeomatics.com> Make sure you use the old PHP.INI from 8.3.26 with all the references to MG. 8.3 versions don't jump that much in mapguide -- if you try with MGOS 3 with PHP 8.1, you definitely get that error. On Wednesday, 21 October 2026 at 15:23, Dan Nilsson via mapguide-users wrote: > Is the php call working well with 8.3.36? > login.php to MapGuide Site Administrator? > > When I use QuickPlot I get an error. > > I get this error: > > Have I done anything wrong? > > I have done a php file that print out the version I have installed: > 8.3.36 > If I go back to the old PHP I get this: > 8.3.26 > > And when I use login.php I get MapGuide Site Administrator as expected > > Br, Dan > > --------------------------------------------------------------- > > Fr?n: mapguide-users f?r GordonL via mapguide-users > Skickat: den 21 oktober 2026 20:56 > Till: MapGuide Users Mail List > Kopia: gordon.luckett at arrowgeomatics.com > ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS > > CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. > > I just tested 8.3.36 without issue (so far). > (just overwrite in place) > > https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3 > > On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users wrote: > >> Good afternoon, >> >> Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP >> >> CVE-2026-109618 & CVE-2026-109619 >> >> My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you. >> >> Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 26495 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 10250 bytes Desc: not available URL: From Dan.Nilsson at tyrens.se Wed Oct 21 12:39:37 2026 From: Dan.Nilsson at tyrens.se (Dan Nilsson) Date: Wed, 21 Oct 2026 19:39:37 +0000 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS In-Reply-To: <_kEkNwAtBUeXLs_3Z5x3O3J3wYzZ9XM1jvvsZq0W0TkjZi1AxqPDRk-XqAXmqsZj7wK0PL8hna3mnNlEDoMsqeuuOtjZm61sS1TfbN2evM0=@arrowgeomatics.com> References: <6AD908C30200007300026E83@mail.aesi-consulting.com> <_kEkNwAtBUeXLs_3Z5x3O3J3wYzZ9XM1jvvsZq0W0TkjZi1AxqPDRk-XqAXmqsZj7wK0PL8hna3mnNlEDoMsqeuuOtjZm61sS1TfbN2evM0=@arrowgeomatics.com> Message-ID: I have this version of MapGuide: [cid:8f0c8f85-9233-480c-8098-79f392516d7b] I stop the IIS and MapGuide service I have downloaded "php-8.3.36-Win32-vs16-x64.zip" (VS16 x64 Thread Safe is this correct?) Copy all the files to PHP folder in MapGuide and replace existing Keeping original php.ini Start the IIS and MapGuide service Try login.php and get this error: PHP Fatal error: Uncaught Error: Class "MgRole" not found in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php:439 Stack trace: #0 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\resizableadmin.php(34): require_once() #1 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\login.php(22): include('...') #2 {main} thrown in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php on line 439 Br, Dan ________________________________ Fr?n: gordon.luckett at arrowgeomatics.com Skickat: den 21 oktober 2026 21:28 Till: MapGuide Users Mail List Kopia: Dan Nilsson ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. Make sure you use the old PHP.INI from 8.3.26 with all the references to MG. 8.3 versions don't jump that much in mapguide -- if you try with MGOS 3 with PHP 8.1, you definitely get that error. On Wednesday, 21 October 2026 at 15:23, Dan Nilsson via mapguide-users wrote: Is the php call working well with 8.3.36? login.php to MapGuide Site Administrator? When I use QuickPlot I get an error. I get this error: [cid:719abc64-5999-407f-8445-c07c618c4fa5] Have I done anything wrong? I have done a php file that print out the version I have installed: 8.3.36 If I go back to the old PHP I get this: 8.3.26 And when I use login.php I get MapGuide Site Administrator as expected [cid:af47f03c-5e97-4dc2-bb17-4c8e89d4874e] Br, Dan ________________________________ Fr?n: mapguide-users > f?r GordonL via mapguide-users > Skickat: den 21 oktober 2026 20:56 Till: MapGuide Users Mail List > Kopia: gordon.luckett at arrowgeomatics.com > ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. I just tested 8.3.36 without issue (so far). (just overwrite in place) https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3 On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users > wrote: Good afternoon, Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP CVE-2026-109618 & CVE-2026-109619 My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you. Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 26495 bytes Desc: image.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 10250 bytes Desc: image.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 89774 bytes Desc: image.png URL: From gordon.luckett at arrowgeomatics.com Wed Oct 21 12:42:39 2026 From: gordon.luckett at arrowgeomatics.com (gordon.luckett at arrowgeomatics.com) Date: Wed, 21 Oct 2026 19:42:39 +0000 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS In-Reply-To: References: <6AD908C30200007300026E83@mail.aesi-consulting.com> <_kEkNwAtBUeXLs_3Z5x3O3J3wYzZ9XM1jvvsZq0W0TkjZi1AxqPDRk-XqAXmqsZj7wK0PL8hna3mnNlEDoMsqeuuOtjZm61sS1TfbN2evM0=@arrowgeomatics.com> Message-ID: <8mEzg-CDEoErCPjt6pNcouDbkGHRnaAliusWCR9jch_CRxmnnWQCWZAUK6NFe_HKTU_xM7YhY8tqLTM8czWTREeIIzTmSPj0BSEse5zmE7s=@arrowgeomatics.com> Use the non-thread safe version: [image.png] On Wednesday, 21 October 2026 at 15:39, Dan Nilsson via mapguide-users wrote: > I have this version of MapGuide: > > I stop the IIS and MapGuide service > > I have downloaded "php-8.3.36-Win32-vs16-x64.zip" (VS16 x64 Thread Safe > is this correct?) > > Copy all the files to PHP folder in MapGuide and replace existing > Keeping original php.ini > > Start the IIS and MapGuide service > Try login.php and get this error: > PHP Fatal error: Uncaught Error: Class "MgRole" not found in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php:439 > Stack trace: > #0 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\resizableadmin.php(34): require_once() > #1 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\login.php(22): include('...') > #2 {main} > thrown in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php on line 439 > > Br, Dan > > --------------------------------------------------------------- > > Fr?n: gordon.luckett at arrowgeomatics.com > Skickat: den 21 oktober 2026 21:28 > Till: MapGuide Users Mail List > Kopia: Dan Nilsson > ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS > > CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. > > Make sure you use the old PHP.INI from 8.3.26 with all the references to MG. > > 8.3 versions don't jump that much in mapguide -- if you try with MGOS 3 with PHP 8.1, you definitely get that error. > > On Wednesday, 21 October 2026 at 15:23, Dan Nilsson via mapguide-users wrote: > >> Is the php call working well with 8.3.36? >> login.php to MapGuide Site Administrator? >> >> When I use QuickPlot I get an error. >> >> I get this error: >> >> Have I done anything wrong? >> >> I have done a php file that print out the version I have installed: >> 8.3.36 >> If I go back to the old PHP I get this: >> 8.3.26 >> >> And when I use login.php I get MapGuide Site Administrator as expected >> >> Br, Dan >> >> --------------------------------------------------------------- >> >> Fr?n: mapguide-users f?r GordonL via mapguide-users >> Skickat: den 21 oktober 2026 20:56 >> Till: MapGuide Users Mail List >> Kopia: gordon.luckett at arrowgeomatics.com >> ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS >> >> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. >> >> I just tested 8.3.36 without issue (so far). >> (just overwrite in place) >> >> https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3 >> >> On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users wrote: >> >>> Good afternoon, >>> >>> Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP >>> >>> CVE-2026-109618 & CVE-2026-109619 >>> >>> My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you. >>> >>> Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 26495 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 10250 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 89774 bytes Desc: not available URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 12701 bytes Desc: not available URL: From Dan.Nilsson at tyrens.se Wed Oct 21 12:50:41 2026 From: Dan.Nilsson at tyrens.se (Dan Nilsson) Date: Wed, 21 Oct 2026 19:50:41 +0000 Subject: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS In-Reply-To: <8mEzg-CDEoErCPjt6pNcouDbkGHRnaAliusWCR9jch_CRxmnnWQCWZAUK6NFe_HKTU_xM7YhY8tqLTM8czWTREeIIzTmSPj0BSEse5zmE7s=@arrowgeomatics.com> References: <6AD908C30200007300026E83@mail.aesi-consulting.com> <_kEkNwAtBUeXLs_3Z5x3O3J3wYzZ9XM1jvvsZq0W0TkjZi1AxqPDRk-XqAXmqsZj7wK0PL8hna3mnNlEDoMsqeuuOtjZm61sS1TfbN2evM0=@arrowgeomatics.com> <8mEzg-CDEoErCPjt6pNcouDbkGHRnaAliusWCR9jch_CRxmnnWQCWZAUK6NFe_HKTU_xM7YhY8tqLTM8czWTREeIIzTmSPj0BSEse5zmE7s=@arrowgeomatics.com> Message-ID: Thanks a lot! It works fine very well with QuickPlot also [cid:dfc71971-05c8-4f13-9259-0b17d4e903d8] Br, Dan ________________________________ Fr?n: gordon.luckett at arrowgeomatics.com Skickat: den 21 oktober 2026 21:42 Till: MapGuide Users Mail List Kopia: Dan Nilsson ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. Use the non-thread safe version: [image.png] On Wednesday, 21 October 2026 at 15:39, Dan Nilsson via mapguide-users wrote: I have this version of MapGuide: [cid:8f0c8f85-9233-480c-8098-79f392516d7b] I stop the IIS and MapGuide service I have downloaded "php-8.3.36-Win32-vs16-x64.zip" (VS16 x64 Thread Safe is this correct?) Copy all the files to PHP folder in MapGuide and replace existing Keeping original php.ini Start the IIS and MapGuide service Try login.php and get this error: PHP Fatal error: Uncaught Error: Class "MgRole" not found in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php:439 Stack trace: #0 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\resizableadmin.php(34): require_once() #1 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\login.php(22): include('...') #2 {main} thrown in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php on line 439 Br, Dan ________________________________ Fr?n: gordon.luckett at arrowgeomatics.com > Skickat: den 21 oktober 2026 21:28 Till: MapGuide Users Mail List > Kopia: Dan Nilsson > ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. Make sure you use the old PHP.INI from 8.3.26 with all the references to MG. 8.3 versions don't jump that much in mapguide -- if you try with MGOS 3 with PHP 8.1, you definitely get that error. On Wednesday, 21 October 2026 at 15:23, Dan Nilsson via mapguide-users > wrote: Is the php call working well with 8.3.36? login.php to MapGuide Site Administrator? When I use QuickPlot I get an error. I get this error: [cid:719abc64-5999-407f-8445-c07c618c4fa5] Have I done anything wrong? I have done a php file that print out the version I have installed: 8.3.36 If I go back to the old PHP I get this: 8.3.26 And when I use login.php I get MapGuide Site Administrator as expected [cid:af47f03c-5e97-4dc2-bb17-4c8e89d4874e] Br, Dan ________________________________ Fr?n: mapguide-users > f?r GordonL via mapguide-users > Skickat: den 21 oktober 2026 20:56 Till: MapGuide Users Mail List > Kopia: gordon.luckett at arrowgeomatics.com > ?mne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious. I just tested 8.3.36 without issue (so far). (just overwrite in place) https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3 On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users > wrote: Good afternoon, Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP CVE-2026-109618 & CVE-2026-109619 My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you. Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments. -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 26495 bytes Desc: image.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 10250 bytes Desc: image.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 89774 bytes Desc: image.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 12701 bytes Desc: image.png URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: image.png Type: image/png Size: 13081 bytes Desc: image.png URL: From jumpinjackie at gmail.com Thu Oct 22 15:13:31 2026 From: jumpinjackie at gmail.com (Jackie Ng) Date: Fri, 23 Oct 2026 09:13:31 +1100 Subject: [mapguide-users] Mitigating php2shell in MGOS 4.0 Message-ID: Hi all, I've made a blog post about how to mitigate the php2shell vulnerability in your MGOS 4.0 installation. https://themapguyde.blogspot.com/2026/10/php2shell-and-mapguide.html If you're on older MapGuide versions, then unfortunately its bundled PHP is outside the version range where a fix for php2shell is available. The only recourse is to upgrade to 4.0 and apply the mitigation in the blog post. - Jackie -------------- next part -------------- An HTML attachment was scrubbed... URL: From jumpinjackie at gmail.com Fri Oct 23 04:01:09 2026 From: jumpinjackie at gmail.com (Jackie Ng) Date: Fri, 23 Oct 2026 22:01:09 +1100 Subject: [mapguide-users] MapGuide Open Source 4.0.1 Message-ID: Hi Ari and Martyn, Sorry for my late reply and inactivity on the mailing list until the php2shell mitigation announcement. I honestly haven't been monitoring the mailing list for months and have been focusing on actual FDO and MapGuide work. To answer your question, 4.0.1 will bundle PHP 8.3.36 (or newer version at the time of actual release), so it will already be insulated against php2shell when it releases. Due to the volume of changes I'm landing into FDO and MapGuide, I'm a bit hesitant to just put out 4.0.1, so I will be doing this as a 2-parter: A 4.0.1-Test release (looking at early November release). I would like users to try this release and just make sure that nothing has regressed. I will allow for 2-3 weeks to iron out any issues found from users testing the 4.0.1-Test release. After that, I will put out 4.0.1 proper, currently looking at late November for this one. Hope that answers your questions. - Jackie You wrote: Hello, I'm also interested in PHP version in next release. Br, Ari to 27.8.2026 klo 17.02 Martyn Andresen via mapguide-users (mapguide-users at lists.osgeo.org ) kirjoitti: >* Hi Jackie - are there any updates as to when MGOS 4.0.1 will be *>* available? Do you know what version of PHP will be used? *>>* Thanks *>* _______________________________________________ *>* mapguide-users mailing list *>* mapguide-users at lists.osgeo.org *>* https://lists.osgeo.org/mailman/listinfo/mapguide-users *> -------------- next part -------------- An HTML attachment was scrubbed... URL: From jumpinjackie at gmail.com Fri Oct 23 04:22:08 2026 From: jumpinjackie at gmail.com (Jackie Ng) Date: Fri, 23 Oct 2026 22:22:08 +1100 Subject: [mapguide-users] SQL Server Spacial - SQL Server Native Client 11.0 vs ODBC Driver 17 for SQL Server Message-ID: Hi Greg, I will be addressing this for the 4.0.1 release. https://trac.osgeo.org/fdo/ticket/1020 - Jackie You wrote: Can Mapguide 4.0 use the ODBC Driver 17 for SQL Server instead of the Native Client? I have tried using the generic odbc connection to the sql server and using a join to a view with that and an .shp feature source with no luck. The join works fine with the native client. Thanks, *Gregory B. Neff* -------------- next part -------------- An HTML attachment was scrubbed... URL: From gbneff at cid.utah.gov Fri Oct 23 09:20:37 2026 From: gbneff at cid.utah.gov (Greg Neff) Date: Fri, 23 Oct 2026 10:20:37 -0600 Subject: [mapguide-users] SQL Server Spacial - SQL Server Native Client 11.0 vs ODBC Driver 17 for SQL Server In-Reply-To: References: Message-ID: <1601a3123b6e76a64cb503161030ca07@mail.gmail.com> That sounds great. Thanks, *Gregory B. Neff* Cottonwood Improvement District 8620 S Highland Dr Sandy, UT 84093 801.943.7671 cottonwoodimprovement.gov *From:* mapguide-users *On Behalf Of *Jackie Ng via mapguide-users *Sent:* Friday, October 23, 2026 5:22 AM *To:* MapGuide Users Mail List *Cc:* Jackie Ng *Subject:* Re: [mapguide-users] SQL Server Spacial - SQL Server Native Client 11.0 vs ODBC Driver 17 for SQL Server Hi Greg, I will be addressing this for the 4.0.1 release. https://trac.osgeo.org/fdo/ticket/1020 - Jackie You wrote: Can Mapguide 4.0 use the ODBC Driver 17 for SQL Server instead of the Native Client? I have tried using the generic odbc connection to the sql server and using a join to a view with that and an .shp feature source with no luck. The join works fine with the native client. Thanks, *Gregory B. Neff* -------------- next part -------------- An HTML attachment was scrubbed... URL: From martyn.andresen at gmail.com Fri Oct 23 14:10:55 2026 From: martyn.andresen at gmail.com (Martyn Andresen) Date: Fri, 23 Oct 2026 17:10:55 -0400 Subject: [mapguide-users] MapGuide Open Source 4.0.1 In-Reply-To: References: Message-ID: Thanks, Jackie. When would you anticipate moving to PHP 8.4? On Fri, Oct 23, 2026 at 7:01?AM Jackie Ng via mapguide-users < mapguide-users at lists.osgeo.org> wrote: > Hi Ari and Martyn, > > Sorry for my late reply and inactivity on the mailing list until the > php2shell mitigation announcement. I honestly haven't been monitoring the > mailing list for months and have been focusing on actual FDO and MapGuide > work. > > To answer your question, 4.0.1 will bundle PHP 8.3.36 (or newer version at > the time of actual release), so it will already be insulated against > php2shell when it releases. > > Due to the volume of changes I'm landing into FDO and MapGuide, I'm a bit > hesitant to just put out 4.0.1, so I will be doing this as a 2-parter: > > A 4.0.1-Test release (looking at early November release). I would like > users to try this release and just make sure that nothing has regressed. I > will allow for 2-3 weeks to iron out any issues found from users testing > the 4.0.1-Test release. > > After that, I will put out 4.0.1 proper, currently looking at late > November for this one. > > Hope that answers your questions. > > - Jackie > > You wrote: > > Hello, > > I'm also interested in PHP version in next release. > > Br, Ari > > > to 27.8.2026 klo 17.02 Martyn Andresen via mapguide-users (mapguide-users at lists.osgeo.org ) kirjoitti: > > >* Hi Jackie - are there any updates as to when MGOS 4.0.1 will be > *>* available? Do you know what version of PHP will be used? > *>>* Thanks > *>* _______________________________________________ > *>* mapguide-users mailing list > *>* mapguide-users at lists.osgeo.org > *>* https://lists.osgeo.org/mailman/listinfo/mapguide-users > *> > > _______________________________________________ > mapguide-users mailing list > mapguide-users at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapguide-users > -------------- next part -------------- An HTML attachment was scrubbed... URL: From ari.hyvonen at gmail.com Sat Oct 24 08:47:09 2026 From: ari.hyvonen at gmail.com (=?UTF-8?B?QXJpIEh5dsO2bmVu?=) Date: Sat, 24 Oct 2026 18:47:09 +0300 Subject: [mapguide-users] MapGuide Open Source 4.0.1 In-Reply-To: References: Message-ID: Thanks Jackie for information and work for updating installation package. Same as Martyn I'm also interested in update of PHP to newer version. PHP 8.6 RC is already out so I think that if there isn't difficult compatibility issues at least 8.4 should be skipped. Our web applications are build using PHP so getting rid of PHP what you wrote on blog would be issue for my organisation. I personally don't have any expertiese using Visual Studio but I can ask around in my organisation if someone could setup Mapguide build environment and maybe we could contribute some assintance regarding PHP version testing. Br, Ari pe 23.10.2026 klo 14.01 Jackie Ng via mapguide-users < mapguide-users at lists.osgeo.org> kirjoitti: > Hi Ari and Martyn, > > Sorry for my late reply and inactivity on the mailing list until the > php2shell mitigation announcement. I honestly haven't been monitoring the > mailing list for months and have been focusing on actual FDO and MapGuide > work. > > To answer your question, 4.0.1 will bundle PHP 8.3.36 (or newer version at > the time of actual release), so it will already be insulated against > php2shell when it releases. > > Due to the volume of changes I'm landing into FDO and MapGuide, I'm a bit > hesitant to just put out 4.0.1, so I will be doing this as a 2-parter: > > A 4.0.1-Test release (looking at early November release). I would like > users to try this release and just make sure that nothing has regressed. I > will allow for 2-3 weeks to iron out any issues found from users testing > the 4.0.1-Test release. > > After that, I will put out 4.0.1 proper, currently looking at late > November for this one. > > Hope that answers your questions. > > - Jackie > > You wrote: > > Hello, > > I'm also interested in PHP version in next release. > > Br, Ari > > > to 27.8.2026 klo 17.02 Martyn Andresen via mapguide-users (mapguide-users at lists.osgeo.org ) kirjoitti: > > >* Hi Jackie - are there any updates as to when MGOS 4.0.1 will be > *>* available? Do you know what version of PHP will be used? > *>>* Thanks > *>* _______________________________________________ > *>* mapguide-users mailing list > *>* mapguide-users at lists.osgeo.org > *>* https://lists.osgeo.org/mailman/listinfo/mapguide-users > *> > > _______________________________________________ > mapguide-users mailing list > mapguide-users at lists.osgeo.org > https://lists.osgeo.org/mailman/listinfo/mapguide-users > -------------- next part -------------- An HTML attachment was scrubbed... URL: From gordon.luckett at arrowgeo.com Mon Oct 26 06:28:29 2026 From: gordon.luckett at arrowgeo.com (Gordon Luckett) Date: Mon, 26 Oct 2026 13:28:29 +0000 Subject: [mapguide-users] MapGuide 4.0 Final (windows) Needing ECW etc Message-ID: GISINTERNALS.com has been down all weekend (DNS hiccup) but with the flurry of upgrades to 4.0 the past few days, a big question has been how to keep supporting ECW with GDAL. Now that the site is up, here is the link to the GDAL: https://gisinternals.com/query2.html?content=filelist&file=release-1900-gdal-2-4-4-mapserver-7-4-3.zip (this worked for me on a number of MGOS 4.0 Windows machines) -------------- next part -------------- An HTML attachment was scrubbed... URL: