Repository navigation
Description
What happened?
The Debian php-zts packages from pkg.henderkes.com version 8.4.25-1 reproducibly crash with SIGILL when using Argon2 password hashing.
Minimal reproducer:
php-zts -r '
$h = password_hash("test123", PASSWORD_ARGON2ID);
var_dump($h);
var_dump(password_verify("test123", $h));
'
With php-zts-cli 8.4.25-1:
Illegal instruction
Bcrypt works correctly:
php-zts -r '
var_dump(password_hash("test123", PASSWORD_BCRYPT));
var_dump(password_verify("test123", password_hash("test123", PASSWORD_BCRYPT)));
'
Result:
string(60) "$2y$..."
bool(true)
The regular Debian PHP 8.4 NTS build also handles Argon2id correctly.
Downgrading only:
php-zts-cli 8.4.25-1 -> 8.4.24-1
php-zts-embed 8.4.25-1 -> 8.4.24-1
fixes the issue immediately.
With 8.4.24-1 the same Argon2id reproducer returns:
string(97) "$argon2id$..."
bool(true)
This also affected FrankenPHP 1.12.7 serving Nextcloud 35.0.1. Authentication caused the FrankenPHP process to terminate with SIGILL. After downgrading php-zts CLI/embed to 8.4.24-1, Nextcloud authentication works.
Backtrace
A coredump from the FrankenPHP crash shows:
#5 decode_string
#6 argon2_verify
#7 ...
#8 ...
#9 execute_ex
#10 zend_execute
#11 zend_execute_script
#12 php_execute_script_ex
Environment
OS: Debian 13 (trixie)
Architecture: amd64
FrankenPHP: 1.12.7+php84-1
php-zts-cli broken: 8.4.25-1
php-zts-embed broken: 8.4.25-1
php-zts-cli working: 8.4.24-1
php-zts-embed working: 8.4.24-1
Repository:
https://pkg.henderkes.com/api/packages/84/debian
The VM was also tested with a host CPU exposing AVX/AVX2 and the crash still occurred, so this does not appear to be caused by the VM exposing an insufficient CPU feature set.
PASSWORD_ARGON2_PROVIDER reports:
string(8) "standard"
for both Debian PHP NTS and php-zts.
Package versions
frankenphp 1.12.7+php84-1
php-zts-cli 8.4.25-1
php-zts-embed 8.4.25-1
Could there be a regression in the Argon2 build/configuration in the 8.4.25-1 php-zts packages?
root@NextCloud:# apt-cache policy php-zts-cli php-zts-embed#
php-zts-cli:
Installed: 8.4.24-1
Candidate: 8.4.25-1
Version table:
8.4.25-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
*** 8.4.24-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
100 /var/lib/dpkg/status
8.4.23-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.22-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.21-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.20-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.19-2 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.19-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.18-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.17-2 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.17-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-7 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-6 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-3 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-2 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
php-zts-embed:
Installed: 8.4.24-1
Candidate: 8.4.25-1
Version table:
8.4.25-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
*** 8.4.24-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
100 /var/lib/dpkg/status
8.4.23-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.22-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.20-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.19-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.18-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.17-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-7 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-6 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
8.4.16-1 500
500 https://pkg.henderkes.com/api/packages/84/debian php-zts/main amd64 Packages
root@NextCloud:
Activity
henderkes commentedon Oct 4, 2026
There are avx512 instructions in the new ones, but I haven't changed anything since 8.4.24-1 afaik. Maybe a gcc update from 16.1 to 16.2. Perhaps github runner hardware changed? Will investigate where that's coming from.