v1: php-5.4.16-48.el7.php2shell.1 and php-5.3.3-50.el6_10.php2shell.1

First release of the unofficial fix for CVE-2026-109618 / CVE-2026-109619 ("php2shell") for the end-of-life
PHP packages of Enterprise Linux 6 and 7.

Distribution	Package
RHEL / CentOS / Oracle Linux / Scientific Linux 7	php-5.4.16-48.el7.php2shell.1
RHEL / CentOS / Oracle Linux 6	php-5.3.3-50.el6_10.php2shell.1

Please read Behaviour changes and known limitations
before you install.

Install

# EL7
curl -o /etc/yum.repos.d/php2shell-eol-backport.repo \
  https://alvm.github.io/php2shell-eol-backport/php2shell-eol-backport-el7.repo
# EL6
curl -o /etc/yum.repos.d/php2shell-eol-backport.repo \
  https://alvm.github.io/php2shell-eol-backport/php2shell-eol-backport-el6.repo

yum update 'php*'
service httpd restart        # and php-fpm, if you use it

Or download the RPMs below and install them with yum localinstall.

How these files were made

• Source: tag v1, commit b796ee5.
• Built by GitHub Actions from that commit:
  run 39835520909. Its log has the
  complete RPM build and the PHP test suite results.
• Signed offline after the build with the project key
  2757 B60F D23D ED25 021B BE37 8079 7C97 A561 BC94. Signing does not change the package header or payload:
  rpm -qp --qf '%{SHA1HEADER}\n' gives the same value for a file here and for the same file in the CI artifact.

Verify the files

gpg --recv-keys 2757B60FD23DED25021BBE3780797C97A561BC94      # or import RPM-GPG-KEY-php2shell-eol-backport
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS
rpm --import RPM-GPG-KEY-php2shell-eol-backport && rpm -K php-*.rpm