PHP 7.4.33 backports (v7.4.33-2)

PHP 7.4 security backports for old Ubuntu and Debian

Still running PHP 7.4 on an old Ubuntu or Debian server? These drop-in .deb
packages patch two critical remote code execution bugs,
CVE-2026-109618 and CVE-2026-109619, on Ubuntu and Debian releases
outside standard support.

Distribution	Supported releases (amd64)
Ubuntu	16.04, 16.10, 17.04, 17.10, 18.04, 18.10, 19.04, 19.10, 20.04
Debian	9 (Stretch), 10 (Buster), 11 (Bullseye)

Warning

PHP 7.4 is end-of-life; these OS releases are outside standard support.
Use this to buy time for an upgrade, not as ongoing security support.

Upgrade

You need Bash, curl, xz-utils and working APT sources for your release.
Back up your PHP configuration first, then run:

target=$(. /etc/os-release; echo "$ID$VERSION_ID")
cd "$(mktemp -d)"
curl -fL "https://github.com/Niek/php7/releases/latest/download/php7.4-$target-amd64.tar.xz" -o php7.4.tar.xz
tar -xJf php7.4.tar.xz
sha256sum -c SHA256SUMS
sudo apt install --only-upgrade ./*.deb

This detects your release (for example ubuntu18.04 or debian10), checks
the package checksums, and upgrades only the PHP 7.4 packages you already have
installed, including extensions, the Apache module and FPM. APT may install
required dependencies. Review APT's proposed changes before accepting.

When it finishes, restart PHP-FPM, Apache or any other long-running PHP process.

What changes

• Fixed: CVE-2026-109618 and CVE-2026-109619, using the
  official upstream backports
  included in Sury's PHP 7.4.33 revision 31.
• Disabled: session upload-progress tracking, as part of the fix. Regular
  file uploads still work.
• On releases with older libraries: PCRE2 is bundled instead of using the
  system copy, and Argon2 password hashing may be unavailable.
• Not included: third-party extensions, such as those from PECL.

How it's built

GitHub Actions downloads the pinned
Sury PHP 7.4.33 source,
verifies it against sources.sha256, then builds it in Docker for each release
using that release's own libraries. Sury's packaging (extensions, FPM config and
services) is kept as-is. build.sh only adjusts what older toolchains need.
The PHP test suite is not run.

Releasing

Every push and pull request builds all releases. To publish, set REVISION in
.github/workflows/build.yml and push the matching tag, for example
v7.4.33-1. The packages, build logs, checksums and source are attached to the
GitHub release once all builds succeed.

PHP 7.4.33 backports (v7.4.33-1)

php7

PHP 7.4 .deb packages for every Ubuntu release from 16.04 through 20.04
(including 16.10, 17.04, 17.10, 18.10, 19.04 and 19.10) and Debian 9/10, amd64.
Built in Docker on ubuntu-latest, using each distribution's native libraries
and Sury's existing Debian packaging, including FPM configuration and services.

The pinned PHP 7.4.33 revision 31 source includes the official backports for
CVE-2026-109618 and CVE-2026-109619. Normal uploads remain available; the
backport disables session upload-progress tracking internally. Builds use bundled
PCRE2 or omit Argon2 where the target distribution lacks suitable native libraries.

Download packages for your exact OS release from Releases,
verify SHA256SUMS, back up your installation, then install the matching .deb
files with APT. PHP 7.4 is EOL and these OS releases are outside normal support;
this is a bridge to upgrading, not a promise of continued security support.

Pushes and pull requests build the matrix. Push v7.4.33-1 to publish packages,
build logs, checksums and corresponding source after all builds succeed. Increase
REVISION in the workflow for subsequent releases. No test suite is run.