v2026.10-php2shell-clarity2

Rebuilds of ppa:ondrej/php's signed sources, unchanged, with the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619): PHP 7.4, 8.0, 8.1, 8.2, 8.3 and 8.4 for Ubuntu 20.04 (focal), and PHP 8.1 for 26.04 (resolute), on arm64 and amd64, plus PHP 8.2 and 8.3 for 26.04 on arm64. Read the README before installing, and snapshot each production node first.

Bundle	sha256
php-backports_7.4.33-31_ubuntu20.04.1_clarity2_focal_amd64.tar	5f9f02bf7a8b86f6909ad837935a349171ef52a6502ddcd9071c32b31e3898f6
php-backports_7.4.33-31_ubuntu20.04.1_clarity2_focal_arm64.tar	9a30ecf217fcfb68e784dea49731f76889a28b55dc3bed4df8372a949d353d99
php-backports_8.0.30-25_ubuntu20.04.1_clarity2_focal_amd64.tar	f45246ac441622f19418a9583733e06587c44a645da1a6cad3fc94cf89c8b3cc
php-backports_8.0.30-25_ubuntu20.04.1_clarity2_focal_arm64.tar	6a060b6da30c6f704fef8fa639fd54316326b26d6411ab443e5cae5745d19ea0
php-backports_8.1.34-9_ubuntu20.04.1_clarity2_focal_amd64.tar	283f3fdaecd686be43b68b79e0650897195dcf673f20b06ba71b7cc975c0f5e3
php-backports_8.1.34-9_ubuntu20.04.1_clarity2_focal_arm64.tar	1046a474a4441115a629b53199bc8310d0b94ffe0cb98ee7bb00449e7faebbca
php-backports_8.1.34-9_ubuntu26.04.1_clarity2_resolute_amd64.tar	24ac0c49b248e2b00e7691cc526fd7aed3ce91d181dc49e7598e37bd470b3ef8
php-backports_8.1.34-9_ubuntu26.04.1_clarity2_resolute_arm64.tar	3048d86f270124ca7d1d7db116550ce75f5a97c58a218d892a2b1053e548b039
php-backports_8.2.35-1_ubuntu26.04.1_clarity2_resolute_arm64.tar	77f082e249e6af237c42a0fd730e49e15188be381e4d3a038d9e8b47a5197b21
php-backports_8.3.36-1_ubuntu26.04.1_clarity2_resolute_arm64.tar	3fe7894a26e15fb71c3c2eef932b526a3a67f1d531edfc362596ce3d1054f078
php-backports_8.2.35-1_ubuntu20.04.1_clarity2_focal_amd64.tar	03e25f2ca5557d00e230ac13019b46bc8b358377e5034531595bad7063a410bc
php-backports_8.2.35-1_ubuntu20.04.1_clarity2_focal_arm64.tar	2146e3740bb26a149d33458b99dbae20ea4f20fc9bea342ab80623063b7d31f5
php-backports_8.3.36-1_ubuntu20.04.1_clarity2_focal_amd64.tar	4f03216af97be6558a40635d2ca2466474e1c8ad61916d37add17f2e1bbf446d
php-backports_8.3.36-1_ubuntu20.04.1_clarity2_focal_arm64.tar	59530cd0733f218e6aa69baddffb1573a190acdd806b4abfa58a4f27f43ddd39
php-backports_8.4.27-1_ubuntu20.04.1_clarity2_focal_amd64.tar	59e904855dc5278c9d77314b9e628498148d67efa55538741532b730e020c876
php-backports_8.4.27-1_ubuntu20.04.1_clarity2_focal_arm64.tar	183f80d4f32f093b7bbe0fb6fc768b10433103c83835994336a9995d409f14d1

Install on a host, one node at a time, simulating first. install.sh works for every branch: it upgrades the host's packages of the bundle's branch.

curl -fsSLO https://github.com/clarity-tech/php-focal-backports/releases/download/v2026.10-php2shell-clarity2/install.sh
sudo bash install.sh simulate 'https://github.com/clarity-tech/php-focal-backports/releases/download/v2026.10-php2shell-clarity2/<bundle>.tar' <sha256>
sudo bash install.sh apply    'https://github.com/clarity-tech/php-focal-backports/releases/download/v2026.10-php2shell-clarity2/<bundle>.tar' <sha256>

Check a bundle's build provenance: gh attestation verify <bundle>.tar --repo clarity-tech/php-focal-backports

The 26.04 arm64 bundles of PHP 8.2 and 8.3 were added on 2026-10-24 from run 40096855704 (commit a7689ee), because packages.sury.org's resolute arm64 index still served pre-fix builds. Their attestations name that run.

v8.1.34-9-clarity1

Superseded by v2026.10-php2shell-clarity2. That release rebuilds php8.1 against the same libraries as the PPA's final Ubuntu 20.04 build, adds PHP 7.4, 8.0, 8.2, 8.3 and 8.4, tests mod_php, and ships an installer that refuses the wrong Ubuntu release and downgrades. Use it instead of the bundles below.

---

Rebuilds of ppa:ondrej/php's signed php8.1 source, unchanged, for Ubuntu 20.04 (focal) and 26.04 (resolute). Read the README before installing, and snapshot each production node first.

Bundle	sha256
php-backports_8.1.34-9_ubuntu20.04.1_clarity1_focal_amd64.tar	e7cc1f442944deeca4adc29a4d576186e146f61074ae5fc8b6b15d3aaa616f40
php-backports_8.1.34-9_ubuntu20.04.1_clarity1_focal_arm64.tar	4659a10c4ada58b11733d09eee9fe945b8558f213a570c5ca2661db5c237c73a
php-backports_8.1.34-9_ubuntu26.04.1_clarity1_resolute_amd64.tar	751e1259395974a2146957af1c7f6485569d67c5e832e8610b6cbc8b45ed7ceb
php-backports_8.1.34-9_ubuntu26.04.1_clarity1_resolute_arm64.tar	ae410c22273aca47f53960ffda9dcefe287de8c104399b8a75f7fc05903bfb9a

Install on a host, one node at a time, simulating first:

curl -fsSLO https://github.com/clarity-tech/php-focal-backports/releases/download/v8.1.34-9-clarity1/install.sh
sudo bash install.sh simulate 'https://github.com/clarity-tech/php-focal-backports/releases/download/v8.1.34-9-clarity1/<bundle>.tar' <sha256>
sudo bash install.sh apply    'https://github.com/clarity-tech/php-focal-backports/releases/download/v8.1.34-9-clarity1/<bundle>.tar' <sha256>

Check a bundle's build provenance: gh attestation verify <bundle>.tar --repo clarity-tech/php-focal-backports