PHP-7.4-CVE-2026-109618-109619 #24527

Activity

1. sebheitzmann

   added

   Bug

   Status: Needs Triage

   on Oct 22, 2026
2. mmauksch commented on Oct 22, 2026

   

   mmauksch

   on Oct 22, 2026

   More actions

   Outside voice: If i remember correctly the official patches are only release for supported versions (8.2+).
   I've heard Ondrej ( https://deb.sury.org/ ) has 7.4 Packages so it's worth a look. And on redhat you might get lucky with https://rpms.remirepo.net/
   Hope it helps in the short term :)

   👍React with 👍1Reacted by Sébastien HEITZMANN
3. xbuddhi commented on Oct 22, 2026

   

   xbuddhi

   on Oct 22, 2026

   More actions

   The branch is the PHP security team's minimal backport for EOL 7.4. There's no PR because it isn't a release. The fix is a single signed commit by a core developer, 712e60f9ed ("Avoid state corruption via bailout. Minimal mitigation for EOL version."), which fixes GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619). Matching branches exist for 8.0 (82f8f31b16) and 8.1 (1d7dec178a).

   Notes from applying it to production 7.4:

   • The branch contains all of 7.4.33's code. It only lacks the two version/NEWS commits, so a build straight from the branch reports a -dev version. To get a build that reports 7.4.33, apply the commit to the release tarball instead. It applies cleanly:

     curl -LO https://www.php.net/distributions/php-7.4.33.tar.gz
     # sha256 5a2337996f07c8a097e03d46263b5c98d2c8e355227756351421003bea8f463e
     tar xzf php-7.4.33.tar.gz && cd php-7.4.33
     curl -L https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2.patch | patch -p1
     

   • It disables session upload progress in code (if (!PS(rfc1867_enabled) || true)), so ini_get('session.upload_progress.enabled') still returns 1 even though the feature is off.
   • Rebuild any shared extensions from the same patched tree, and restart or reload php-fpm. The running workers keep the old binary until you do.

   If you'd rather use packages: sury's 7.4 packages carry the fix (per HestiaCP users), and Ubuntu 20.04 got it through Ubuntu Pro ESM (USN-8948-2). For RHEL-family or Debian 11, check remi / your vendor / Freexian ELTS.

   (Disclosure: I scripted the source-build steps for control-panel servers like aaPanel: https://github.com/xbuddhi/php2shell-fix)

   👍React with 👍3Reacted by Sergei, max-maurice and Denny Septian Panggabean
4. sebheitzmann commented on Oct 22, 2026

   

   sebheitzmann

   on Oct 22, 2026

   Author

   More actions

   It's ok for me. Thanks for your time. I close this issue
5. sebheitzmann

   closed this as completedon Oct 22, 2026
6. Fabienjulio commented on Oct 23, 2026

   

   Fabienjulio

   on Oct 23, 2026

   More actions

   I'm a little late but, for future reference, it's been back-ported on sury's repos on debian:
   https://salsa.debian.org/php-team/php/-/commit/cac8fdc3c72aae27aff513032a7d1416dba71565

   👍React with 👍1Reacted by Alejo A. Sotelo