php2shell-eol-backport

Unofficial fix for CVE-2026-109618 and CVE-2026-109619 ("php2shell") for the end-of-life PHP packages of Enterprise Linux 6 and 7.

Distribution	Fixed package
RHEL / CentOS / Oracle Linux / Scientific Linux 7	`php-5.4.16-48.el7.php2shell.1`
RHEL / CentOS / Oracle Linux 6	`php-5.3.3-50.el6_10.php2shell.1`

Install

# EL7
curl -o /etc/yum.repos.d/php2shell-eol-backport.repo \
  https://alvm.github.io/php2shell-eol-backport/php2shell-eol-backport-el7.repo

# EL6
curl -o /etc/yum.repos.d/php2shell-eol-backport.repo \
  https://alvm.github.io/php2shell-eol-backport/php2shell-eol-backport-el6.repo

yum update 'php*'
service httpd restart        # and php-fpm, if you use it

Packages and repository metadata are signed with this key (yum asks you to confirm it on first use):

2757 B60F D23D ED25 021B  BE37 8079 7C97 A561 BC94

This is not an official fix from PHP, Red Hat or Oracle. Read the behaviour changes and known limitations before you install, and move to a supported PHP version as soon as you can.

Source, build scripts, test results and the security policy: github.com/alvm/php2shell-eol-backport. Release files: GitHub Releases.