SHM PHP security source log
PHP slot: 74
PHP version: 7.4.33
Source strategy: security-backports
Official source SHA256: 924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927
Legacy overlay mode: reviewed-security-overlay
Legacy overlay action: partially-applied-upstream
Overlay manifest SHA256: 94946187e74711ea8cc2041288443b8c4de68412f5ee9f5a18ca5902843bc2e4
Integrated SHM FPM patch SHA256: e1fd29979a914831500e28381b7380f4d6612a3465f70dc527f80e9bcf3df43b
Remi security revision: 802c21075308066362aab4993478dcd0577993a6
Remi cumulative patch SHA256: 954616b323158da379efda6784227079ef5136321ccfda8fb455a9e5b634dda2
Reviewed overlay SHA256: f327447695f70e25983e8fdb7ea0c9094713f0558a5923a307ecb27b2962e937
Effective overlay SHA256: 561fb84e8412a259ec095e943cb959a741ccc250dfdd7d2eda6ab2d262b9fd5c
Reviewed overlay identifiers:
- CVE-2022-4900
- CVE-2024-11235
- CVE-2025-1218
- CVE-2025-14181
- CVE-2026-6103
- CVE-2026-7260
- CVE-2026-91765
- CVE-2026-91766
- CVE-2026-91767
- CVE-2026-91768
- CVE-2026-91769
- CVE-2026-92842
- CVE-2026-93682
- GHSA-62xp-839h-2637
- GHSA-7875-c8px-7q5f
- GHSA-88hq-2827-7pg6
- GHSA-ch8v-r6jh-4vvr
- GHSA-cj93-vc83-wgqv
- GHSA-fpwc-w8rq-cr92
- GHSA-j3wh-g957-2m85
- GHSA-r6x9-5r99-36j7
- GHSA-rgrp-mwpx-f6rm
- GHSA-vc5h-9ppw-p5f3
- GHSA-vvx9-73fr-5jjx
- GHSA-xr7j-rvgx-xq5p
Reviewed security-relevant bug fixes without a public identifier:
- none
Public source inputs:
- https://github.com/php/php-src/commit/ef2c459941b5ffae501e5311f5ac2041aadbe461 (patch SHA256 f487408ec20ebad9a9ffa6a82039a91bef43d51cf76267b9d3c2209892a6c705)
- https://github.com/php/php-src/commit/2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 (patch SHA256 2646ad1f3d90abdfc5eee74d852c28e35cc7a1005cc94d8cdb57381ef00ab985)
- https://github.com/remicollet/php-src-security/commit/01fc3ebce0742a38316b3fef6807a595dab3be06 (patch SHA256 f12651b868901754e39be7de7f3f2b0679a57a62b822e528e0e0749a870b7fff)
- https://github.com/remicollet/php-src-security/commit/19b922a7e44ee4a35b4bdd636a8d45c390b5a9b3 (patch SHA256 5d04196fe901032a9f1c5b9aaea2b0f351f1755906b2e980ce464d93faf17fa0)
- https://github.com/remicollet/php-src-security/commit/1b443f4b0e3730f65dcbbcf6bbe19063e433f809 (patch SHA256 3bbf472b540d1560f6d367be0d1ff9fce258a2bca1dfbcb2877c4883fa91aa10)
- https://github.com/remicollet/php-src-security/commit/22be1f2e13e0bdd6d086342f2208d71e6662f140 (patch SHA256 9df484b9a510e23c299d47d4428c3374183a6278e88463506a69d8d51edbf993)
- https://github.com/remicollet/php-src-security/commit/6db1c1da4f80d1162c04997deffddd6a6d8a205a (patch SHA256 71dd58edfe6d77c59ff752e2754891dcb80dc5d9320eaf34667f8ebfe409495d)
- https://github.com/remicollet/php-src-security/commit/bb9058d1d85201d79240e3aed29e4b59213b41f0 (patch SHA256 d0c9b9c992716a919f8b9bcedb471be18090cfd4d4f0c19b341afd6c08423673)
- https://github.com/remicollet/php-src-security/commit/e1845be6ed76bea7b120330ec316cf470e906dfe (patch SHA256 0516ae6db11786444504defef9ed4f80ff823ca351833a247c9a726c5b986ad6)
- https://github.com/remicollet/php-src-security/commit/e1ae7c43933a8fb933beee712a3bc7f500ed7aae (patch SHA256 40d344e59f4c89b6fd0ab9ca4ac99df47a8e9332fbfaf51ff9b03856fe7cad9d)
- https://github.com/remicollet/php-src-security/commit/eb3554af131ec1ff4874891e657b7dc9d91cfd7a (patch SHA256 9a3a4b5453c6e7c91cffc13fc14ca65ae91e775d817c8861076b0d00c617db69)
- https://github.com/remicollet/php-src-security/commit/215c255c8827a52a69f2a9c34b1165d8101c059d (patch SHA256 effb38a24a8c17166112e8fa1000f3e4bf7dd154fdf7830138c63a83e2b2206f)
- https://github.com/php/php-src/commit/8196275133edb830ec85330d36659d5b257b44db (patch SHA256 81b5487f591d9ec462867023a7ede8a2925dbc95e0c194bfa63bfdd18a1b7b03)
- https://github.com/php/php-src/commit/de3436c76e460ca44829cc8234926280d96ceae6 (patch SHA256 fd057df8e020fcb94282b8f1495decfea3cd160dc1ec3ed8c9d09a0c9b4f6fbe)
- https://github.com/php/php-src/commit/789a37f14405e2d1a05a76c9fb4ed2d49d4580d5 (patch SHA256 715df9dae42d8f51043599c8727bd519754d663b4c41ad876b879ae055f41bb5)
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: applied
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
- Effective runtime correction SHA256: ff1cd6169d6ad0fcfba9f7d711968f083bca2a66cbf1f8ac9aac62a8e9f60fff
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability coverage guarantee.
