PHP 8.0.30 security backports for CentOS 7 x86_64

PHP 8.0.30-100.local.sec20261030.el7 for x86_64

Signed conventional PHP RPMs for CentOS 7.9, with the full source and rebuild materials. This is a locally validated upgrade candidate. Production deployment has not been validated.

Download php80-el7-public-8.0.30-100-sec20261030-el7-x86_64.tar.gz for the full package tree, or download individual RPMs. The bundle includes 19 binary RPMs and one source RPM. The binary packages are php, php-bcmath, php-cli, php-common, php-gd, php-gmp, php-imap, php-intl, php-ldap, php-mbstring, php-mysqlnd, php-opcache, php-pdo, php-process, php-pspell, php-soap, php-sodium, php-tidy and php-xml.

• Remi security tree pinned to 2026-10-29, including the official October mitigation for CVE-2026-109618 and CVE-2026-109619.
• EL7 ICU 73 calendar correction, bundled GD and generated scanner ctype synchronization.
• Recorded PHPT: 14,338 PASS, 0 FAIL, 38 XFAIL, 4 WARN and 2,806 SKIP.
• Recorded installed-RPM checks: 45 CLI and 10 Apache checks passing, with isolated upgrade, downgrade and container snapshot recovery.

All 20 RPMs retain RSA-4096/SHA-256 signatures from fingerprint B07748530C39253A9E8520F56100DD2FE34B4B53. BUILD-SHA256SUMS and .asc preserve the original signed manifest. The cleaned public bundle and the new asset SHA256SUMS are unsigned. See SIGNATURES.md for the exact verification procedure.

The source includes 92 exact SRPM inputs, patches, php80.spec, public verification keys and build/validation scripts. Raw host logs and phpinfo dumps are excluded. The missing public key from the original release folder was restored from a matching copy, without changing any RPM.

Session upload progress is disabled. OOM can terminate a worker without normal cleanup. Read known limitations and rehearse the exact target transaction before deployment. This package does not establish continuing support for EOL PHP, CentOS or their dependencies.