SHM PHP security source log
PHP slot: 56
PHP version: 5.6.40
Source strategy: security-backports
Official source SHA256: 1369a51eee3995d7fbd1c5342e5cc917760e276d561595b6052b21ace2656d1c
Legacy overlay mode: reviewed-security-overlay
Legacy overlay action: applied
Overlay manifest SHA256: e403d989e83e63af03bf23735aef56504523b4e16c6ea5d1753acf576d4a0e79
Integrated SHM FPM patch SHA256: 0487ec18db0a812ff830ac7b71524c8f2b4e79faaad58bebab9a404aa91713d4
Remi security revision: 7df1c2b14e40d1c9f84b2903e925ef4c9f6d2373
Remi cumulative patch SHA256: 1be8328a74d2789ce131bc31d08523171f812d200db8f40ac2dd38add9ef586b
Reviewed overlay SHA256: ba832b8d8e5aeba8cc4257574a74158ef1e5759aedf3fd2ab7a42950d6dfa6f5
Effective overlay SHA256: ba832b8d8e5aeba8cc4257574a74158ef1e5759aedf3fd2ab7a42950d6dfa6f5
Reviewed overlay identifiers:
- CVE-2019-9025
- CVE-2025-1217
- CVE-2025-1218
- CVE-2025-1220
- CVE-2025-14177
- CVE-2025-14181
- CVE-2025-1734
- CVE-2025-1735
- CVE-2025-1736
- CVE-2025-1861
- CVE-2025-6491
- CVE-2026-17543
- CVE-2026-6103
- CVE-2026-6722
- CVE-2026-7258
- CVE-2026-7260
- CVE-2026-7568
- CVE-2026-91765
- CVE-2026-91766
- CVE-2026-91767
- CVE-2026-91768
- CVE-2026-91769
- CVE-2026-92842
- CVE-2026-93682
- CVE-2026-9672
- GHSA-3237-qqm7-mfv7
- GHSA-3cr5-j632-f35r
- GHSA-453j-q27h-5p8x
- GHSA-52jp-hrpf-2jff
- GHSA-62xp-839h-2637
- GHSA-7875-c8px-7q5f
- GHSA-7qpv-r5mr-78m4
- GHSA-85c2-q967-79q5
- GHSA-88hq-2827-7pg6
- GHSA-96wq-48vp-hh57
- GHSA-ch8v-r6jh-4vvr
- GHSA-cj93-vc83-wgqv
- GHSA-fpwc-w8rq-cr92
- GHSA-hgf5-96fm-v528
- GHSA-hrwm-9436-5mv3
- GHSA-j3wh-g957-2m85
- GHSA-m8rr-4c36-8gq4
- GHSA-pcmh-g36c-qc44
- GHSA-r6x9-5r99-36j7
- GHSA-rgrp-mwpx-f6rm
- GHSA-v8xr-gpvj-cx9g
- GHSA-vc5h-9ppw-p5f3
- GHSA-vvx9-73fr-5jjx
- GHSA-www2-q4fc-65wf
- GHSA-xr7j-rvgx-xq5p
Reviewed security-relevant bug fixes without a public identifier:
- 69dee5c732fe982c82edb17d0dbc3e79a47748d8: Fix PHP bug #73342 by keeping the FPM listener independent from stdin
- cc5c51e7f0732067f105d13c6d355fcab5965c2f: Fix PHP bug #77934 by closing the duplicated FPM listener during graceful reload
- 8d3dfabef459fe7815e8ea2fd68753fd17859d7b: Harden empty DNS RDATA handling for PHP bug #77369
- 8f949eba8083e34d181c30bcf11aaeef2496bb97: Backport the Oniguruma bounds guard for PHP bug #78559
Public source inputs:
- https://github.com/remicollet/php-src-security/commit/22be1f2e13e0bdd6d086342f2208d71e6662f140 (patch SHA256 9df484b9a510e23c299d47d4428c3374183a6278e88463506a69d8d51edbf993)
- https://github.com/php/php-src/commit/2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52 (patch SHA256 2646ad1f3d90abdfc5eee74d852c28e35cc7a1005cc94d8cdb57381ef00ab985)
- https://github.com/remicollet/php-src-security/commit/bb9058d1d85201d79240e3aed29e4b59213b41f0 (patch SHA256 d0c9b9c992716a919f8b9bcedb471be18090cfd4d4f0c19b341afd6c08423673)
- https://github.com/remicollet/php-src-security/commit/e1ae7c43933a8fb933beee712a3bc7f500ed7aae (patch SHA256 40d344e59f4c89b6fd0ab9ca4ac99df47a8e9332fbfaf51ff9b03856fe7cad9d)
- https://github.com/remicollet/php-src-security/commit/19b922a7e44ee4a35b4bdd636a8d45c390b5a9b3 (patch SHA256 5d04196fe901032a9f1c5b9aaea2b0f351f1755906b2e980ce464d93faf17fa0)
- https://github.com/remicollet/php-src-security/commit/1b7410a57f8a5fd1dd43854bcf7b9200517c9fd2 (patch SHA256 09ef326f5022927d155e4adbd8b791509f7fc572419a827d4ad8c76f7a5d0f8f)
- https://github.com/remicollet/php-src-security/commit/36150278addd8686a9899559241296094bd57282 (patch SHA256 039dec08ed491e3f081f8379e3122e9d1e3f2d6472e96a6f1f5475c5b817d28a)
- https://github.com/remicollet/php-src-security/commit/6db1c1da4f80d1162c04997deffddd6a6d8a205a (patch SHA256 71dd58edfe6d77c59ff752e2754891dcb80dc5d9320eaf34667f8ebfe409495d)
- https://github.com/remicollet/php-src-security/commit/e1845be6ed76bea7b120330ec316cf470e906dfe (patch SHA256 0516ae6db11786444504defef9ed4f80ff823ca351833a247c9a726c5b986ad6)
- https://github.com/remicollet/php-src-security/commit/1b443f4b0e3730f65dcbbcf6bbe19063e433f809 (patch SHA256 3bbf472b540d1560f6d367be0d1ff9fce258a2bca1dfbcb2877c4883fa91aa10)
- https://github.com/php/php-src/commit/9376aeef9f8ff81f2705b8016237ec3e30bdee44 (patch SHA256 d2a36f61367a7ec0335d3a7ccd1dfe229bda67ba476cb7b36d8fb1ed42660f6e)
- https://github.com/remicollet/php-src-security/commit/531196af8ccc43c26ca97aef27b0816e8b4e2f60 (patch SHA256 1af196484352a1206f79563622ff4865f7a7842ff1c2fb299d2b63876817b8fd)
- https://github.com/php/php-src/commit/b11bd1d9390bb203684e3d4aa5e1104ea842de6f (patch SHA256 87ee8dce57906a4717885296dbf648fe27015c9cc207d11b90b6a203e9b89609)
- https://github.com/php/php-src/commit/114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2 (patch SHA256 fc61846d6765ac060f447a35a504d73609437f0acabc67952de2a5adf6bf3f2b)
- https://github.com/remicollet/php-src-security/commit/215c255c8827a52a69f2a9c34b1165d8101c059d (patch SHA256 effb38a24a8c17166112e8fa1000f3e4bf7dd154fdf7830138c63a83e2b2206f)
- https://github.com/php/php-src/commit/d20b4c97a9f883b62b65b82d939c5af9a2028ef1 (patch SHA256 6988d4c01c175915a2e0d2c5697f523f2f8e1e871092de7c108b14b3b4a7c43b)
- https://github.com/php/php-src/commit/0548c4c1756724a89ef8310709419b08aadb2b3b (patch SHA256 eb9d6b534531e6d2bc8a8d28e479711d29463041a7a9a9c92b44bc9a88247efe)
- https://github.com/php/php-src/commit/ac1a054bb3eb5994a199e8b18cca28cbabf5943e (patch SHA256 1a36770fe08d6f1f10560eb5154aa32ae600a3ceb57e06656be401bf076a0a6b)
- https://github.com/php/php-src/commit/5af9465ca890be679033d5fb0dc89b6ea071326b (patch SHA256 92a0742088f285990304a6dbc8d36269645bc8b9b95e7cc58e2d2c5ac4a53221)
- https://github.com/php/php-src/commit/8196275133edb830ec85330d36659d5b257b44db (patch SHA256 81b5487f591d9ec462867023a7ede8a2925dbc95e0c194bfa63bfdd18a1b7b03)
- https://github.com/php/php-src/commit/de3436c76e460ca44829cc8234926280d96ceae6 (patch SHA256 fd057df8e020fcb94282b8f1495decfea3cd160dc1ec3ed8c9d09a0c9b4f6fbe)
- https://github.com/remicollet/php-src-security/commit/bbc1be3fc763b81707ccaa91a4cd1d439b753b12 (patch SHA256 e8b80f246049eb0b1dcd791a22a6690ba9bac93725c0ad27a9b4716f22fd088e)
- https://github.com/php/php-src/commit/fcd691b377d02285740744bee17c0f298be227d5 (patch SHA256 902cd3236996257ada6e313185848fd3ff1d13a3c2f36187946ad0165f8077a5)
- https://github.com/remicollet/php-src-security/commit/30de2f8492a06ebcf1659307f1f049e2799c7f21 (patch SHA256 7d559e3b96a4991f014bf020de7f482c8d46eb9cc7e03903df744341fbfd8573)
- https://github.com/remicollet/php-src-security/commit/52c5762a902e8731b7068ded027fbd780f5a1991 (patch SHA256 b2f405a6dddeccbb12881ad428e2b7b13e383fcadbdaf952c25754bb6db2e2d0)
- https://github.com/remicollet/php-src-security/commit/53de456406a6db5a8bcded8a4b242789ae5b2690 (patch SHA256 4d7db6457a2bd9234452cd0e94f2a7dddec0c5590647d304b548608a1dda0c16)
- https://github.com/remicollet/php-src-security/commit/ed665eb1903737d2b52b27368b155f6208604ed9 (patch SHA256 60c3ee30be410ba61d78a5ce4c2d63f709c82ce6e0f04687ea0c19fc074221d2)
- https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8 (patch SHA256 c4e9a51f7760ee13d7f467e35dbf4004374fe6a2bf466699cb43485e475a2e04)
- https://github.com/php/php-src/commit/cc5c51e7f0732067f105d13c6d355fcab5965c2f (patch SHA256 709ad4c1bbfec15be3e89c3f816e14837c92b104cfbbd6c60673caa49bd43a56)
- https://github.com/php/php-src/commit/8d3dfabef459fe7815e8ea2fd68753fd17859d7b (patch SHA256 e39cc72472f83c41eecf7e4a6435d4522922465ac1e16a52015ca49017013a57)
- https://github.com/php/php-src/commit/11ce508ee3390d4e68542c9fdae1277e3e75a573 (patch SHA256 976dd62a4c834cd4012cc138cbc04dc5946ce049b650727125e33fd05ebb4bea)
- https://github.com/php/php-src/commit/8f949eba8083e34d181c30bcf11aaeef2496bb97 (patch SHA256 65d9a07c126fd6eb5089cfeb238b7745207cb49c76630d73938708efc5d6eb84)
Explicit component exclusions:
- PDO DBLIB / CVE-2024-11236: No SHM PHP build enables or packages PDO DBLIB.
- PDO Firebird / CVE-2024-11236, CVE-2025-14179: No SHM PHP build enables or packages PDO Firebird.
Runtime source corrections:
- PHP issue #8699: not-affected-no-ini-get-fold
- Keep ini_get() runtime-bound across OPcache-shared requests and FPM pools; other optimizations remain enabled.
- https://github.com/php/php-src/issues/8699
Vendor implementation inputs:
- none; no CloudLinux or TuxCare implementation code is included.
Coverage notice:
- Reviewed identifiers describe the fixes represented by this overlay and are not a universal vulnerability or private-vendor coverage guarantee.
