Critical PHP updates

[Drakar]

We have backported the new PHP patching sub-system to the RHEL 7 branch. A new build is pushed out to the rhel7 and debian10 legacy release channels. It comes with latest PHP versions and all security patches (not just the latest CVEs).

---

@Richpark yes, the one patch file is for both CVEs.

You guys are the best! Thank you so much for your hard work and support! Really appreciate it!

 

[Aar]

How i really know if i'm patched or not?
I already execute the da update + da build php.

I can see the follow patch on most of versions of PHP



That's mean that i'm "safe/patched" or do i need to do another procedure?

If this patch-file exists, the patch has been applied after a PHP re-build.

 

[hostpanel]

If this patch-file exists, the patch has been applied after a PHP re-build.

Thank you for your response, but how about the other cve? cve-2026-109619 the patch is the same as 618?

Also I notice that 8.2/8.3/8.4 doesn't have the patch on the folder...is that normal?

 

[pat0]

PHP 8.2+ was updated directly by php devs.