NES for PHP 5 on Windows

NES for PHP 5 for Windows is PHP 5.6.40 with HeroDevs security fixes, as a zip you unpack and run: a drop-in replacement for the PHP 5.6.40 zip you use today. The current release is v5.6.40-nes-5.6.2.

Supported Platforms

Each release is tested on Windows Server 2016 and Windows Server 2022.

The zip is the thread-safe (TS) x64 build, made with Visual C++ 2012 (VC11) as PHP 5.6's own Windows builds are. It runs PHP from the command line, from IIS through FastCGI and from Apache. Its extension build is API20131226,TS,VC11, so extensions built for PHP 5.6 thread-safe x64 (VC11), such as PECL extensions, load in it as they do in any other PHP 5.6 build of that kind.

Access

NES for PHP 5 is distributed through the NES registry at registry.nes.herodevs.com and requires an access token. If you do not have one, contact support@herodevs.com. For more information, see Access Tokens.

The zip is at https://registry.nes.herodevs.com/bin/nes/php/v5.6.40-nes-5.6.2/php-v5.6.40-nes-5.6.2.windows.x64.ts.zip. Authenticate with your contact e-mail and your access token.

Prerequisites

The zip needs two Microsoft runtimes, which it does not include. Download them from Microsoft:

• the Visual C++ Redistributable for Visual Studio 2012 Update 4 (x64), version 11.0.61030 or later, for PHP itself;
• the Visual C++ Redistributable for Visual Studio 2015-2026 (x64), version 14.51.36247 or later, for OpenSSL and the other libraries beside php.exe.

Then check the versions:

(Get-Item "$env:windir\System32\msvcr110.dll").VersionInfo.FileVersion
(Get-Item "$env:windir\System32\vcruntime140.dll").VersionInfo.FileVersion

Without the first, php.exe does not start (exit code -1073741515). Without the second, PHP starts but the OpenSSL, cURL and PostgreSQL extensions do not load.

To verify the download, install Gpg4win, which provides gpg.

Download and verify

In an empty directory, download the signing key, the checksums and the zip:

$base = "https://registry.nes.herodevs.com/bin/nes/php/v5.6.40-nes-5.6.2"
$auth = "<your-contact-email>:<your-nes-access-token>"
foreach ($f in "RPM-GPG-KEY-php-nes", "SHASUMS256.txt", "SHASUMS256.txt.asc", "php-v5.6.40-nes-5.6.2.windows.x64.ts.zip") {
  curl.exe -fSLO -u $auth "$base/$f"
}

Then verify the downloads. gpg --verify must report a good signature, and the last command must print True:

gpg --show-keys .\RPM-GPG-KEY-php-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import .\RPM-GPG-KEY-php-nes
gpg --verify .\SHASUMS256.txt.asc .\SHASUMS256.txt
$expected = (Select-String -Path .\SHASUMS256.txt -SimpleMatch "php-v5.6.40-nes-5.6.2.windows.x64.ts.zip").Line.Split(" ")[0]
(Get-FileHash -Algorithm SHA256 .\php-v5.6.40-nes-5.6.2.windows.x64.ts.zip).Hash -eq $expected

The programs in the zip are not Authenticode-signed: the signed checksums are how you check the download.

Install

Unpack the zip to C:\php and add that folder to the system Path:

Expand-Archive -LiteralPath .\php-v5.6.40-nes-5.6.2.windows.x64.ts.zip -DestinationPath C:\php
[Environment]::SetEnvironmentVariable("Path", [Environment]::GetEnvironmentVariable("Path", "Machine") + ";C:\php", "Machine")

Open a new PowerShell window and check the installation:

php -v
php -i | Select-String "Thread Safety"

The first shows PHP 5.6.40-nes (cli), the second Thread Safety => enabled.

Configure

PHP reads the php.ini in its own folder. Start from the production settings:

Copy-Item C:\php\php.ini-production C:\php\php.ini

In php.ini, remove the ; from the extension_dir = "ext" line and set it to "C:\php\ext". Enable each extension you use by removing the ; from its extension= line, for example extension=php_curl.dll, extension=php_mbstring.dll and extension=php_openssl.dll. Then check what loads:

php --ini
php -m

IIS

IIS runs PHP through FastCGI. Install the CGI feature (Install-WindowsFeature Web-CGI), then in IIS Manager open Handler Mappings and add a module mapping:

and set these in php.ini:

fastcgi.impersonate = 1
cgi.fix_pathinfo = 1
cgi.force_redirect = 0

Apache

For a 64-bit Apache 2.4, add these lines to httpd.conf and restart Apache:

LoadModule php5_module "C:/php/php5apache2_4.dll"
PHPIniDir "C:/php"
AddType application/x-httpd-php .php

Move from another PHP 5.6 zip

To switch from the PHP 5.6.40 zip you use now, replace its folder as described under Upgrade, and install the second runtime above. These differ:

• The extension build is the same (API20131226,TS,VC11), so the extension DLLs you load today keep loading.
• OpenSSL is 3.5.9, where the zip you use now has OpenSSL 1.0.2: libeay32.dll and ssleay32.dll are gone, and an extension DLL built against them does not load. Ciphers OpenSSL 3 moved to its legacy provider, such as RC4, the default of openssl_seal(), fail with an OpenSSL error unless that provider is loaded. The legacy provider is in extras\ssl.
• These extensions are not in the zip yet: intl, ldap, imap, tidy, snmp, oci8 and pdo_oci (with their DLLs, such as the ICU ones), and enchant. Remove their extension= lines from your php.ini, or PHP warns that it cannot load them at startup. The gd extension reads and writes no WebP images.
• pg_trace() is not supported: it warns and returns false.

Upgrade

Download and verify the new release's zip as above. Stop the web server or application that uses PHP, then replace the folder and keep your php.ini:

Rename-Item C:\php C:\php-old
Expand-Archive -LiteralPath .\php-<release>.windows.x64.ts.zip -DestinationPath C:\php
Copy-Item C:\php-old\php.ini C:\php\php.ini
php -v

Start the web server or application again. Compare your php.ini with the new php.ini-production for settings the release adds, then remove C:\php-old.

Uninstall

Stop the web server or application that uses PHP, remove the C:\php folder and remove C:\php from the system Path.