SHM PHP security source log
PHP slot: 81
PHP version: 8.1.34
Source strategy: security-backports
Official source SHA256: ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251
Legacy overlay mode: reviewed-security-overlay
Legacy overlay action: applied
Overlay manifest SHA256: 94946187e74711ea8cc2041288443b8c4de68412f5ee9f5a18ca5902843bc2e4
Integrated SHM FPM patch SHA256: a824eb9a4deb6506ba5a00ebedf799a1091e360b6fafb2f20257cba565e5bc66
Remi security revision: 1e06d14cdc77d28b88d2daa99bdfdd4dfaae831b
Remi cumulative patch SHA256: 63fc0ccccbb28ae53f35c45fb29618f3843712ad990f1be79c12c68498ccfb40
Reviewed overlay SHA256: d3d6e936fd52728bc34a05d5af2edf27d3fd4c9b88f2408ddc1a45e8a5aae44d
Effective overlay SHA256: d3d6e936fd52728bc34a05d5af2edf27d3fd4c9b88f2408ddc1a45e8a5aae44d
Reviewed overlay identifiers:
- CVE-2024-11235
- CVE-2026-7260
- GHSA-vc5h-9ppw-p5f3
Reviewed security-relevant bug fixes without a public identifier:
- none
Public source inputs:
- https://github.com/php/php-src/commit/ef2c459941b5ffae501e5311f5ac2041aadbe461 (patch SHA256 f487408ec20ebad9a9ffa6a82039a91bef43d51cf76267b9d3c2209892a6c705)
- https://github.com/php/php-src/commit/2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 (patch SHA256 2646ad1f3d90abdfc5eee74d852c28e35cc7a1005cc94d8cdb57381ef00ab985)
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: applied
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
- Effective runtime correction SHA256: 8cebc1f6a7ee126cf506da27d39cb2d41ce58fac832ecd15cc429623cbd16699
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability coverage guarantee.
