SHM PHP security source log
PHP slot: 81
PHP version: 8.1.34
Source strategy: security-backports
Official source SHA256: ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251
Legacy overlay mode: reviewed-security-overlay
Legacy overlay action: applied
Overlay manifest SHA256: 93fb500dcd55b6c507ea3655a40a53bd287df05eda224d3c79101ec9c15a100e
Integrated SHM FPM patch SHA256: a824eb9a4deb6506ba5a00ebedf799a1091e360b6fafb2f20257cba565e5bc66
Remi security revision: ed316bc682381472fa0c530a799905a6ec4f7e71
Remi cumulative patch SHA256: f94470145c4c318c1b615ad1caf8023f0ea3af15ee26cb188fa2aec24db6b1dc
Reviewed overlay SHA256: d3d6e936fd52728bc34a05d5af2edf27d3fd4c9b88f2408ddc1a45e8a5aae44d
Effective overlay SHA256: d3d6e936fd52728bc34a05d5af2edf27d3fd4c9b88f2408ddc1a45e8a5aae44d
Reviewed overlay identifiers:
- CVE-2024-11235
- CVE-2026-7260
- GHSA-vc5h-9ppw-p5f3
Reviewed security-relevant bug fixes without a public identifier:
- none
Public source inputs:
- https://github.com/php/php-src/commit/ef2c459941b5ffae501e5311f5ac2041aadbe461 (patch SHA256 f487408ec20ebad9a9ffa6a82039a91bef43d51cf76267b9d3c2209892a6c705)
- https://github.com/php/php-src/commit/2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 (patch SHA256 2646ad1f3d90abdfc5eee74d852c28e35cc7a1005cc94d8cdb57381ef00ab985)
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: applied
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
- Effective runtime correction SHA256: 8cebc1f6a7ee126cf506da27d39cb2d41ce58fac832ecd15cc429623cbd16699
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability coverage guarantee.
