SHM PHP security source log
PHP slot: 85
PHP version: 8.5.11
Source strategy: official
Official source SHA256: d9be75c08e8c316f4c8f4194d8fbe1750a15f6a6d9d4e3fe72082abeeb800360
Legacy overlay mode: official-source-only
Legacy overlay action: official-source-no-legacy-overlay
Overlay manifest SHA256: e403d989e83e63af03bf23735aef56504523b4e16c6ea5d1753acf576d4a0e79
Integrated SHM FPM patch SHA256: 39f43c7e25cb10723985a66256d379065b67c154672b78fde225838e0073ef78
Runtime reliability correction: child shutdown signals remain blocked through initialization.
Reviewed overlay identifiers:
- none; this slot uses the selected official source without a legacy overlay
Reviewed security-relevant bug fixes without a public identifier:
- none
Public source inputs:
- none; use the official release provenance above
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: applied
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
- Effective runtime correction SHA256: e86a1df607b055f0588487f213dbd6d3f3c9bf58153938551ce51b370dfa5dc8
Vendor implementation inputs:
- none; no CloudLinux or TuxCare implementation code is included.
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability or private-vendor coverage guarantee.
