LiteSpeed and PHP: updating lsphp so the fixed build is the one running

Package	Branch	Ubuntu 24.04, Debian 12 and 13	Enterprise Linux 9
lsphp85	PHP 8.5	8.5.12-1 plus the release name	8.5.12-1.el9
lsphp84	PHP 8.4	8.4.27-1 plus the release name	8.4.27-1.el9
lsphp83	PHP 8.3	8.3.36-1 plus the release name	8.3.36-1.el9
lsphp82	PHP 8.2	8.2.35-1 plus the release name	8.2.35-1.el9

Per virtual host

Switching a virtual host to another lsphp version

Needed when a site runs a branch with no fix, or when you are moving between branches anyway. Install the target branch first:

# Ubuntu and Debian
sudo apt-get install lsphp84 lsphp84-common lsphp84-mysql

# RHEL family (the MySQL package is called mysqlnd here)
sudo dnf install lsphp84 lsphp84-common lsphp84-mysqlnd

OpenLiteSpeed, in the WebAdmin console

• Whole server: under Server Configuration > External App, edit the lsphp entry and set Command to the build you want, for example lsphp84/bin/lsphp. Keep Max Connections and PHP_LSAPI_CHILDREN equal. The Script Handler maps the php suffix to that app with the type LiteSpeed SAPI.
• One virtual host: under Virtual Hosts > your host > Script Handlers, add a handler that points at an External App for the other build, such as one named lsphp84. Settings at this level override the server's.

OpenLiteSpeed, in the configuration file

# /usr/local/lsws/conf/httpd_config.conf (excerpt; leave the other lines)
extprocessor lsphp {
  type                    lsapi
  address                 uds://tmp/lshttpd/lsphp.sock
  path                    lsphp84/bin/lsphp
}

scripthandler  {
  add                     lsapi:lsphp php
}

Change only the path line, then apply it with the restart commands from step 4. OpenLiteSpeed's documentation is explicit that the change does nothing until both PHP and the server restart.

LiteSpeed Web Server

Set handlers under Configuration > Server > PHP, where Default PHP Versions decides what serves .php files when nothing more specific applies. A virtual host with no handler of its own inherits the server's. On a standalone server, a site can also pick its version in .htaccess, following the pattern in LiteSpeed's standalone guide:

<IfModule Litespeed>
AddHandler application/x-httpd-php84 .php
</IfModule>

Changing branch can affect the application, unlike a patch release on the same branch, so test the site after the switch.

Interim measures

Interim PHP settings for lsphp

If a fixed build cannot go on today, the PHP project's partial measures go in the php.ini of each lsphp build. The PHP project is clear that none of them is a complete mitigation.

Find the php.ini a build loads

/usr/local/lsws/lsphp83/bin/lsphp -i | grep -i 'loaded configuration file'

Add the settings

; In the php.ini this lsphp build loads. Partial measures, not a fix.
session.upload_progress.enabled = 0
; PHP 8.5 builds only:
fatal_error_backtraces = 0

• Restart the detached processes afterwards. PHP reads php.ini when a process starts, and the advisory itself says to restart workers after these changes.
• Session upload progress has to be switched off in configuration; ini_set() in application code cannot do it. The advisory suggests keeping it off even after patching, if nothing on the site uses it.
• The advisory's pm.max_requests suggestion is a PHP-FPM pool setting. It does not apply to lsphp, and the advisory names no LSAPI equivalent.

The full list, including request limits in front of PHP, is on the PHP2Shell page. If no fix or interim measure can go on soon, work through whether to take the site offline.