How exactly do security fixes get to the users in PHP?

Question

I want to understand the process to go from a security bug report to a running system having the bug fix applied. Especially how long it takes from the bug being public until the bug is fixed on the running system. I heard it only takes 1 hour from a bug being public until hackers use exploits to attack running systems.

Let's take PHP as example and debian (server version) is the OS which is running PHP stuff.

I think first the bug is reported to bugs.php.net first and marked as a security bug so it's not public.

Then someone from the PHP team creates a bug fix.

But then I don't know any further. It might be the bug fix is applied to a private security repository. But I am not sure. See PHP wiki

What happens next? Do debian package maintainers get the fix before it is public? So they can apply it before hackers do know of the bug?

How much time does pass from the bug being public until the fix is available in the apt repository?

How much time does pass until debian downloads the fix (the new apt package) automatically? Is it possible to get real-time updates?

Answer 1

That are quite a few questions and not all have the same answers for all upstream projects and all Linux distributions.

What happens next? Do debian package maintainers get the fix before it is public?

If your distribution is important enough and you can be trusted, you may get notice before the fix is published, so you can prepare the fixed package. Debian may have the privilege for high impact bugs, some smaller distros do not have it.

So they can apply it before hackers do know of the bug?

That's the idea. Of course, you never know who knew the bug before.

How much time does pass from the bug being public until the fix is available in the apt repository?

Again it depends on the distribution and the maintainer and how they got informed. With responsible disclosure (information before the general public gets informed) it will be very close to the public release. Otherwise the maintainer probably is on the right mailing lists to get informed and will prepare an update soon. That depends on the time they got for maintaining their package.

How much time does pass until debian downloads the fix (the new apt package) automatically?

This depends on your configuration and the mirror you're using. For important security fixes there are mirrors that are updated quickly after a fix is available (that's why there is a line for security updates that is diffrent from the line for usual packages in your apt/sources.list), for others it may take a day for your mirror to fetch the updated package.

Your installation then needs to update the package list and install the fix. And this may happen automatically (usually at most once a day) or even manually. If your admin read the right security mailing lists and IT news, they will know there is a fix and manually refresh the package list and update the affected package.

Is it possible to get real-time updates?

Updates are always a fetch mechanism. First you check if there is an update, then you install the update. So nothing is "real-time". But packaging an update and uploading it is not exactly "real-time" either.