[mapguide-users] Patching PHP Vulnerabilities in MapGuide OS

[Dan Nilsson]

I have this version of MapGuide:
[cid:8f0c8f85-9233-480c-8098-79f392516d7b]
I stop the IIS and MapGuide service

I have downloaded "php-8.3.36-Win32-vs16-x64.zip" (VS16 x64 Thread Safe
is this correct?)

Copy all the files to PHP folder in MapGuide and replace existing
Keeping original php.ini

Start the IIS and MapGuide service
Try login.php and get this error:
PHP Fatal error:  Uncaught Error: Class "MgRole" not found in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php:439
Stack trace:
#0 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\resizableadmin.php(34): require_once()
#1 C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\login.php(22): include('...')
#2 {main}
  thrown in C:\Program Files\OSGeo\MapGuide\Web\www\mapadmin\serverdatafunctions.php on line 439

Br, Dan

________________________________
Från: gordon.luckett at arrowgeomatics.com <gordon.luckett at arrowgeomatics.com>
Skickat: den 21 oktober 2026 21:28
Till: MapGuide Users Mail List <mapguide-users at lists.osgeo.org>
Kopia: Dan Nilsson <Dan.Nilsson at tyrens.se>
Ämne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious.

Make sure you use the old PHP.INI from 8.3.26 with all the references to MG.

8.3 versions don't jump that much in mapguide -- if you try with MGOS 3 with PHP 8.1, you definitely get that error.

On Wednesday, 21 October 2026 at 15:23, Dan Nilsson via mapguide-users <mapguide-users at lists.osgeo.org> wrote:

Is the php call working well with 8.3.36?
login.php to MapGuide Site Administrator?

When I use QuickPlot I get an error.

I get this error:
[cid:719abc64-5999-407f-8445-c07c618c4fa5]

Have I done anything wrong?

I have done a php file that print out the version I have installed:
8.3.36
If I go back to the old PHP I get this:
8.3.26

And when I use login.php I get MapGuide Site Administrator as expected
[cid:af47f03c-5e97-4dc2-bb17-4c8e89d4874e]

Br, Dan
________________________________
Från: mapguide-users <mapguide-users-bounces at lists.osgeo.org<mailto:mapguide-users-bounces at lists.osgeo.org>> för GordonL via mapguide-users <mapguide-users at lists.osgeo.org<mailto:mapguide-users at lists.osgeo.org>>
Skickat: den 21 oktober 2026 20:56
Till: MapGuide Users Mail List <mapguide-users at lists.osgeo.org<mailto:mapguide-users at lists.osgeo.org>>
Kopia: gordon.luckett at arrowgeomatics.com<mailto:gordon.luckett at arrowgeomatics.com> <gordon.luckett at arrowgeomatics.com<mailto:gordon.luckett at arrowgeomatics.com>>
Ämne: Re: [mapguide-users] Patching PHP Vulnerabilities in MapGuide OS

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender. Report if suspicious.

I just tested 8.3.36 without issue (so far).
(just overwrite in place)

https://www.php.net/downloads.php?os=windows&osvariant=windows-downloads&version=8.3

On Wednesday, 21 October 2026 at 14:53, Kyle Parker via mapguide-users <mapguide-users at lists.osgeo.org<mailto:mapguide-users at lists.osgeo.org>> wrote:
Good afternoon,

Is patching the PHP version bundled with MapGuide possible? There has been a new update from php.net to address certain security vulnerabilities with PHP

CVE-2026-109618 & CVE-2026-109619

My team is currently running Mapguide 4.0.0.10202, and PHP Version 8.3.26. Would updating PHP to 8.3.35 be possible without issue or would it cause problems with mapguide? Thank you.


Confidentiality Notice: The information contained in this message and any attachments may contain confidential or proprietary material and is intended solely for the use of the person or entity to which it is addressed. Any unauthorized review, use, disclosure or distribution of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of this communication and any attachments.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/mapguide-users/attachments/20261021/11e636a9/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 26495 bytes
Desc: image.png
URL: <http://lists.osgeo.org/pipermail/mapguide-users/attachments/20261021/11e636a9/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 10250 bytes
Desc: image.png
URL: <http://lists.osgeo.org/pipermail/mapguide-users/attachments/20261021/11e636a9/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 89774 bytes
Desc: image.png
URL: <http://lists.osgeo.org/pipermail/mapguide-users/attachments/20261021/11e636a9/attachment-0002.png>