SHM PHP security source log
PHP slot: 80
PHP version: 8.0.30
Source strategy: security-backports
Official source SHA256: 216ab305737a5d392107112d618a755dc5df42058226f1670e9db90e77d777d9
Legacy overlay mode: reviewed-security-overlay
Legacy overlay action: applied
Overlay manifest SHA256: 94946187e74711ea8cc2041288443b8c4de68412f5ee9f5a18ca5902843bc2e4
Integrated SHM FPM patch SHA256: db2e5919b0cd61f84e7029bbea098c4821ed37982b910fb71f8c2ba600e68537
Remi security revision: c280bab5ab0e83319c9f245e02f48de0a56ebbd6
Remi cumulative patch SHA256: b545188478e0a354154fe9c5cc49fd48d10503f30edffadf39bd81ef014c2dcd
Reviewed overlay SHA256: 1b468fa5f25535b4dbe0a893d829b5e3b95972400383ee016bee3d6fde34dc14
Effective overlay SHA256: 1b468fa5f25535b4dbe0a893d829b5e3b95972400383ee016bee3d6fde34dc14
Reviewed overlay identifiers:
- CVE-2024-11235
- CVE-2026-7260
- CVE-2026-93682
- GHSA-7875-c8px-7q5f
- GHSA-vc5h-9ppw-p5f3
Reviewed security-relevant bug fixes without a public identifier:
- none
Public source inputs:
- https://github.com/php/php-src/commit/ef2c459941b5ffae501e5311f5ac2041aadbe461 (patch SHA256 f487408ec20ebad9a9ffa6a82039a91bef43d51cf76267b9d3c2209892a6c705)
- https://github.com/php/php-src/commit/2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 (patch SHA256 2646ad1f3d90abdfc5eee74d852c28e35cc7a1005cc94d8cdb57381ef00ab985)
- https://github.com/php/php-src/commit/8196275133edb830ec85330d36659d5b257b44db (patch SHA256 81b5487f591d9ec462867023a7ede8a2925dbc95e0c194bfa63bfdd18a1b7b03)
- https://github.com/php/php-src/commit/de3436c76e460ca44829cc8234926280d96ceae6 (patch SHA256 fd057df8e020fcb94282b8f1495decfea3cd160dc1ec3ed8c9d09a0c9b4f6fbe)
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: applied
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
- Effective runtime correction SHA256: 6917a6117f9d8155d730edff327cfb9bf54955ad48d146f75c17596c4b71c80f
CVE-2025-1218 source review:
- All production hunks of the referenced upstream fix are present; no exploit test.
- Upstream fix: 114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2
- Remi backport: 215c255c8827a52a69f2a9c34b1165d8101c059d
- Historical upstream NEWS wording is retained; all 50 production hunks were checked.
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability coverage guarantee.
