# PHP 8.4.27 configure writes to read-only source tree but exits successfully

- Thread: https://externals.io/message/132904
- Original archive: https://news-web.php.net/php.internals/132904
- Started by Kangwa Mukonda on 2026-10-23T09:51:56+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #132904 — Kangwa Mukonda — 2026-10-23T09:51:56+00:00

URL: https://externals.io/message/132904#132904

Kangwa Mukonda <mukondakangwa1@gmail.com>
11:44 AM (5 minutes ago)



to internals
Hello PHP internals,

I found a reproducible out-of-tree build-system issue in the signed PHP
8.4.27 release. I am using the internals list because bugs.php.net no
longer accepts reports and GitHub is unavailable in this environment.

Summary

When configure is run out of tree with the authenticated PHP source mounted
read-only, it attempts to create main/php_config.h.in.tmp inside the source
tree. The write fails with "Read-only file system", but configure
continues, creates the build Makefile, prints its success banner, and exits
with status 0.

Source

PHP 8.4.27 official tar.xz
SHA-256: dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0
Signature verified with PHP 8.4 release-manager key
9D7F99A0CB8F05C8A6958D6256A97AF7600A39A6.
The archive also matched Debian's independently signed php8.4
8.4.27-1~deb13u1 source byte-for-byte.

Environment

Kali rolling, x86_64
Linux 7.1.5+kali-amd64
GCC 15.3.0
GNU Make 4.4.1
Bubblewrap with a new network namespace; system and source trees read-only;
out-of-tree build directory writable.

Minimal reproduction

1. Extract php-8.4.27.tar.xz.
2. Create a separate writable build directory.
3. Make or mount the source tree read-only.
4. From the build directory run:

/path/to/php-8.4.27/configure --disable-all --enable-cli --disable-cgi
--disable-phpdbg --without-pear

Observed result

configure exit status: 0
Makefile created: yes
success banner printed: yes
read-only write failure count: 1

Relevant output:

configure: creating Makefile
configure: patching main/php_config.h.in
/path/to/php-8.4.27/configure: line 93943:
/path/to/php-8.4.27/main/php_config.h.in.tmp: Read-only file system
Thank you for using PHP.

Expected result

For a supported out-of-tree configuration, configure should not modify the
source tree. If modification is unavoidable, the failed write should be
fatal and configure should return a nonzero status instead of reporting
success.

Additional result

The generated build subsequently compiled successfully, so this report
concerns the unexpected source-tree write and swallowed failure rather than
a compilation failure.

Evidence

Full configure log SHA-256:
860f4189fb5c1b9b3a3aae43ff8ad498cbab6bbd4582d7c9e6a40beb71fe11f5

No exploit was developed or executed. I can provide the complete configure
log and reproduction receipt if useful.

Regards,
Mukonda Kangwa
Email: mukondakangwa1@gmail.com
Phone / Airtel: +260 773 695 472
Lusaka, Zambia