SHM PHP security source log
PHP slot: 85
PHP version: 8.5.12
Source strategy: official
Official source SHA256: 08bc2eba2a588654ade1357174aa646b761556c862dda0678345ee29ed481209
Legacy overlay mode: official-source-only
Legacy overlay action: official-source-no-legacy-overlay
Overlay manifest SHA256: 94946187e74711ea8cc2041288443b8c4de68412f5ee9f5a18ca5902843bc2e4
Integrated SHM FPM patch SHA256: 39f43c7e25cb10723985a66256d379065b67c154672b78fde225838e0073ef78
Runtime reliability correction: child shutdown signals remain blocked through initialization.
Reviewed overlay identifiers:
- none; this slot uses the selected official source without a legacy overlay
Reviewed security-relevant bug fixes without a public identifier:
- none
Public source inputs:
- none; use the official release provenance above
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: applied
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
- Effective runtime correction SHA256: e86a1df607b055f0588487f213dbd6d3f3c9bf58153938551ce51b370dfa5dc8
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability coverage guarantee.
