SHM PHP security source log
PHP slot: 73
PHP version: 7.3.33
Source strategy: security-backports
Official source SHA256: 166eaccde933381da9516a2b70ad0f447d7cec4b603d07b9a916032b215b90cc
Legacy overlay mode: reviewed-security-overlay
Legacy overlay action: applied
Overlay manifest SHA256: e403d989e83e63af03bf23735aef56504523b4e16c6ea5d1753acf576d4a0e79
Integrated SHM FPM patch SHA256: c0836e3915a8bfdbcbbf60cdfd784696d09725fd3901e13ba8fe3d19266f41dc
Remi security revision: f9e099c02fc0d8c37bd538eeaf48f4e0f3671d91
Remi cumulative patch SHA256: 5fb7404b91eed4b0e13aba4e84f4aed63c8e9332ad1639cf31499de14dab16db
Reviewed overlay SHA256: c8c0c921b52d79bbc70bbbe2637969bbc86f2e8079eb882acbdec25def999a10
Effective overlay SHA256: c8c0c921b52d79bbc70bbbe2637969bbc86f2e8079eb882acbdec25def999a10
Reviewed overlay identifiers:
- CVE-2017-8923
- CVE-2017-9118
- CVE-2017-9120
- CVE-2025-1217
- CVE-2025-1218
- CVE-2025-1220
- CVE-2025-14177
- CVE-2025-14181
- CVE-2025-1734
- CVE-2025-1735
- CVE-2025-1736
- CVE-2025-1861
- CVE-2025-6491
- CVE-2026-17543
- CVE-2026-6103
- CVE-2026-7258
- CVE-2026-7260
- CVE-2026-91765
- CVE-2026-91766
- CVE-2026-91767
- CVE-2026-91768
- CVE-2026-91769
- CVE-2026-92842
- CVE-2026-93682
- GHSA-3237-qqm7-mfv7
- GHSA-3cr5-j632-f35r
- GHSA-453j-q27h-5p8x
- GHSA-52jp-hrpf-2jff
- GHSA-62xp-839h-2637
- GHSA-7875-c8px-7q5f
- GHSA-7qpv-r5mr-78m4
- GHSA-88hq-2827-7pg6
- GHSA-ch8v-r6jh-4vvr
- GHSA-cj93-vc83-wgqv
- GHSA-fpwc-w8rq-cr92
- GHSA-hgf5-96fm-v528
- GHSA-hrwm-9436-5mv3
- GHSA-j3wh-g957-2m85
- GHSA-m8rr-4c36-8gq4
- GHSA-pcmh-g36c-qc44
- GHSA-r6x9-5r99-36j7
- GHSA-rgrp-mwpx-f6rm
- GHSA-v8xr-gpvj-cx9g
- GHSA-vc5h-9ppw-p5f3
- GHSA-vvx9-73fr-5jjx
- GHSA-www2-q4fc-65wf
- GHSA-xr7j-rvgx-xq5p
Reviewed security-relevant bug fixes without a public identifier:
- none
Public source inputs:
- https://github.com/remicollet/php-src-security/commit/22be1f2e13e0bdd6d086342f2208d71e6662f140 (patch SHA256 9df484b9a510e23c299d47d4428c3374183a6278e88463506a69d8d51edbf993)
- https://github.com/php/php-src/commit/2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 (patch SHA256 2646ad1f3d90abdfc5eee74d852c28e35cc7a1005cc94d8cdb57381ef00ab985)
- https://github.com/remicollet/php-src-security/commit/bb9058d1d85201d79240e3aed29e4b59213b41f0 (patch SHA256 d0c9b9c992716a919f8b9bcedb471be18090cfd4d4f0c19b341afd6c08423673)
- https://github.com/remicollet/php-src-security/commit/e1ae7c43933a8fb933beee712a3bc7f500ed7aae (patch SHA256 40d344e59f4c89b6fd0ab9ca4ac99df47a8e9332fbfaf51ff9b03856fe7cad9d)
- https://github.com/remicollet/php-src-security/commit/19b922a7e44ee4a35b4bdd636a8d45c390b5a9b3 (patch SHA256 5d04196fe901032a9f1c5b9aaea2b0f351f1755906b2e980ce464d93faf17fa0)
- https://github.com/remicollet/php-src-security/commit/1b7410a57f8a5fd1dd43854bcf7b9200517c9fd2 (patch SHA256 09ef326f5022927d155e4adbd8b791509f7fc572419a827d4ad8c76f7a5d0f8f)
- https://github.com/remicollet/php-src-security/commit/36150278addd8686a9899559241296094bd57282 (patch SHA256 039dec08ed491e3f081f8379e3122e9d1e3f2d6472e96a6f1f5475c5b817d28a)
- https://github.com/remicollet/php-src-security/commit/6db1c1da4f80d1162c04997deffddd6a6d8a205a (patch SHA256 71dd58edfe6d77c59ff752e2754891dcb80dc5d9320eaf34667f8ebfe409495d)
- https://github.com/remicollet/php-src-security/commit/e1845be6ed76bea7b120330ec316cf470e906dfe (patch SHA256 0516ae6db11786444504defef9ed4f80ff823ca351833a247c9a726c5b986ad6)
- https://github.com/remicollet/php-src-security/commit/1b443f4b0e3730f65dcbbcf6bbe19063e433f809 (patch SHA256 3bbf472b540d1560f6d367be0d1ff9fce258a2bca1dfbcb2877c4883fa91aa10)
- https://github.com/php/php-src/commit/9376aeef9f8ff81f2705b8016237ec3e30bdee44 (patch SHA256 d2a36f61367a7ec0335d3a7ccd1dfe229bda67ba476cb7b36d8fb1ed42660f6e)
- https://github.com/remicollet/php-src-security/commit/531196af8ccc43c26ca97aef27b0816e8b4e2f60 (patch SHA256 1af196484352a1206f79563622ff4865f7a7842ff1c2fb299d2b63876817b8fd)
- https://github.com/php/php-src/commit/b11bd1d9390bb203684e3d4aa5e1104ea842de6f (patch SHA256 87ee8dce57906a4717885296dbf648fe27015c9cc207d11b90b6a203e9b89609)
- https://github.com/php/php-src/commit/114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2 (patch SHA256 fc61846d6765ac060f447a35a504d73609437f0acabc67952de2a5adf6bf3f2b)
- https://github.com/remicollet/php-src-security/commit/215c255c8827a52a69f2a9c34b1165d8101c059d (patch SHA256 effb38a24a8c17166112e8fa1000f3e4bf7dd154fdf7830138c63a83e2b2206f)
- https://github.com/php/php-src/commit/d20b4c97a9f883b62b65b82d939c5af9a2028ef1 (patch SHA256 6988d4c01c175915a2e0d2c5697f523f2f8e1e871092de7c108b14b3b4a7c43b)
- https://github.com/php/php-src/commit/0548c4c1756724a89ef8310709419b08aadb2b3b (patch SHA256 eb9d6b534531e6d2bc8a8d28e479711d29463041a7a9a9c92b44bc9a88247efe)
- https://github.com/php/php-src/commit/ac1a054bb3eb5994a199e8b18cca28cbabf5943e (patch SHA256 1a36770fe08d6f1f10560eb5154aa32ae600a3ceb57e06656be401bf076a0a6b)
- https://github.com/php/php-src/commit/5af9465ca890be679033d5fb0dc89b6ea071326b (patch SHA256 92a0742088f285990304a6dbc8d36269645bc8b9b95e7cc58e2d2c5ac4a53221)
- https://github.com/php/php-src/commit/8196275133edb830ec85330d36659d5b257b44db (patch SHA256 81b5487f591d9ec462867023a7ede8a2925dbc95e0c194bfa63bfdd18a1b7b03)
- https://github.com/php/php-src/commit/de3436c76e460ca44829cc8234926280d96ceae6 (patch SHA256 fd057df8e020fcb94282b8f1495decfea3cd160dc1ec3ed8c9d09a0c9b4f6fbe)
- https://github.com/remicollet/php-src-security/commit/30de2f8492a06ebcf1659307f1f049e2799c7f21 (patch SHA256 7d559e3b96a4991f014bf020de7f482c8d46eb9cc7e03903df744341fbfd8573)
- https://github.com/remicollet/php-src-security/commit/52c5762a902e8731b7068ded027fbd780f5a1991 (patch SHA256 b2f405a6dddeccbb12881ad428e2b7b13e383fcadbdaf952c25754bb6db2e2d0)
- https://github.com/php/php-src/commit/4c47ccc47927d5fd4ba4746246ee0304f8b3da83 (patch SHA256 224e1a3d13301213e1f130f82cc6e1b8576d95242713f2137d58bee7c35169fb)
- https://github.com/php/php-src/commit/8cc7a73d326a84bda02bb87b8750624067500529 (patch SHA256 96a846d03b9d7425e6c730af7e1530a1d0e878a4574dcf2be7abc4eaae278d6e)
- https://github.com/php/php-src/commit/712fc54e856d3d8e80a7d074a2733bc6b3a27e90 (patch SHA256 bc7b1b2794788e9d060e1eb77942011f5fc8cfc04b3f44b63969d1bdc8b9a98d)
- https://github.com/php/php-src/commit/5977610de1aa87630e40a299a2d90fb7cd00bf7c (patch SHA256 e0471c5845d80088f952c6f23c168f91e671a8d6b14503039cf9ecee4db1072d)
- https://github.com/remicollet/php-src-security/commit/ed665eb1903737d2b52b27368b155f6208604ed9 (patch SHA256 60c3ee30be410ba61d78a5ce4c2d63f709c82ce6e0f04687ea0c19fc074221d2)
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: applied
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
- Effective runtime correction SHA256: 11a43da8afbdd57bd1c22ae3a060d34523a35a0731a0acd9ea05bc83903f6d06
Vendor implementation inputs:
- none; no CloudLinux or TuxCare implementation code is included.
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability or private-vendor coverage guarantee.
