CentOS 7 Remi php73 7.3.33-24.sizlon1 (PHP2Shell)

Unofficial rebuilt RPMs for CentOS 7 + Remi php73. Supersedes el7-php73-7.3.33-23.sizlon1, which runs the same code.

• Base: Remi php-7.3.33-24.remi.src.rpm (published for EL8/EL9 only), rebuilt unchanged. It includes the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619), with the shutdown-time handler reset that Remi -23 was missing, and two SOAP fixes (CVE-2026-91765, CVE-2025-14181).
• Version: 7.3.33-24.sizlon1.el7. In-place yum upgrade verified from the last Remi el7 build (7.3.33-14) and from 23.sizlon1.
• If you run 23.sizlon1, there is no need to hurry: the code is the same. 24.sizlon1 is built from Remi's source alone, without a patch of this repository.

Verification: reports/el7-remi-php73.md
Read before applying: EXPECTED-CHANGES.md
(session upload progress is disabled; a worker exits immediately when it runs out of memory → nginx 502)

Install

Run on the server. This downloads only the packages already installed there, checks them against SHA256SUMS and upgrades them in place. How to check the result and roll back: Installing the packages in the README.

TAG=el7-php73-7.3.33-24.sizlon1 VR=7.3.33-24.sizlon1
URL=https://github.com/ngenieer/php-eol-backports/releases/download/$TAG
mkdir -p ~/php-update && cd ~/php-update
curl -fsSLO "$URL/SHA256SUMS"
for p in $(rpm -qa 'php*' --qf '%{NAME}\n'); do
  f="$p-$VR.el7.x86_64.rpm"
  if awk -v f="$f" '$2 == f' SHA256SUMS | grep -q .; then
    curl -fsSLO "$URL/$f"; awk -v f="$f" '$2 == f' SHA256SUMS >> SHA256SUMS.mine
  else echo "not in this release: $p"; fi
done
sha256sum -c SHA256SUMS.mine          # every line must say OK
sudo yum localinstall ./*.rpm
sudo systemctl restart php-fpm        # and/or httpd when PHP runs as mod_php

Note: these packages are not built or endorsed by php.net or Remi. The RPMs are not GPG-signed. Test on staging before applying to production.

Debian 10 Sury php7.3 7.3.33-35 rebuild (PHP2Shell)

Unofficial rebuilt packages for Debian 10 (buster) + Sury PHP 7.3. Sury stopped building for this release, so Sury's current source was rebuilt unmodified on Debian 10 (buster).

• Base: Sury php7.3 7.3.33-35 source (includes the PHP2Shell fix, CVE-2026-109618 and CVE-2026-109619)
• Version: …+sizlon1. Upgrades in place with apt from the distribution's php7.3 and from older Sury builds.
• Source versions and SHA256 checksums are pinned in deb/sources.txt.

Verification: reports/deb-sury-rebuild.md
Read before applying: EXPECTED-CHANGES.md
(session upload progress is disabled; a worker exits immediately when it runs out of memory → nginx 502)

If you run the distribution's own PHP, prefer the vendor fix (Debian: Freexian ELTS, Ubuntu: Ubuntu Pro ESM) over these packages.

Install

Run on the server. This downloads only the packages already installed there, checks them against SHA256SUMS and upgrades them in place. How to check the result and roll back: Installing the packages in the README.

TAG=deb-buster-php7.3-7.3.33-35-sizlon1 X=7.3
URL=https://github.com/ngenieer/php-eol-backports/releases/download/$TAG
mkdir -p ~/php-update && cd ~/php-update
dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' "php$X*" "libapache2-mod-php$X" "libphp$X-embed" 2>/dev/null \
  | awk '$1 == "ii" {print $2, $3}' > versions-before.txt
curl -fsSLO "$URL/SHA256SUMS"
for p in $(awk '{print $1}' versions-before.txt); do
  if awk -v p="${p}_" 'index($2, p) == 1' SHA256SUMS | grep -q .; then
    awk -v p="${p}_" 'index($2, p) == 1' SHA256SUMS | tee -a SHA256SUMS.mine | while read -r h f; do curl -fsSLO "$URL/$f"; done
  else echo "not in this release: $p"; fi
done
sha256sum -c SHA256SUMS.mine          # every line must say OK
sudo apt install ./*.deb
sudo systemctl restart php$X-fpm      # and/or apache2 when PHP runs as mod_php

Note: these packages are not built or endorsed by Sury. The packages are unsigned. Test on staging before applying to production.

Ubuntu 18.04 Sury php7.2 7.2.34-66 rebuild (PHP2Shell)

Unofficial rebuilt packages for Ubuntu 18.04 (bionic) + Sury PHP 7.2. Sury stopped building for this release, so Sury's current source was rebuilt unmodified on Ubuntu 18.04 (bionic).

• Base: Sury php7.2 7.2.34-66 source (includes the PHP2Shell fix, CVE-2026-109618 and CVE-2026-109619)
• Version: …+sizlon1. Upgrades in place with apt from the distribution's php7.2 and from older Sury builds.
• Source versions and SHA256 checksums are pinned in deb/sources.txt.
• php-common: requires php-common (>= 1:81~). Servers that used the Sury PPA already have 2:9x and are fine. Servers with only Ubuntu's php-common (1:60) must also install Sury's php-common; for those servers, Ubuntu Pro ESM is recommended.

Verification: reports/deb-sury-rebuild.md
Read before applying: EXPECTED-CHANGES.md
(session upload progress is disabled; a worker exits immediately when it runs out of memory → nginx 502)

If you run the distribution's own PHP, prefer the vendor fix (Debian: Freexian ELTS, Ubuntu: Ubuntu Pro ESM) over these packages.

Install

Run on the server. This downloads only the packages already installed there, checks them against SHA256SUMS and upgrades them in place. How to check the result and roll back: Installing the packages in the README.

TAG=deb-bionic-php7.2-7.2.34-66-sizlon1 X=7.2
URL=https://github.com/ngenieer/php-eol-backports/releases/download/$TAG
mkdir -p ~/php-update && cd ~/php-update
dpkg-query -W -f '${db:Status-Abbrev} ${Package} ${Version}\n' "php$X*" "libapache2-mod-php$X" "libphp$X-embed" 2>/dev/null \
  | awk '$1 == "ii" {print $2, $3}' > versions-before.txt
curl -fsSLO "$URL/SHA256SUMS"
for p in $(awk '{print $1}' versions-before.txt); do
  if awk -v p="${p}_" 'index($2, p) == 1' SHA256SUMS | grep -q .; then
    awk -v p="${p}_" 'index($2, p) == 1' SHA256SUMS | tee -a SHA256SUMS.mine | while read -r h f; do curl -fsSLO "$URL/$f"; done
  else echo "not in this release: $p"; fi
done
sha256sum -c SHA256SUMS.mine          # every line must say OK
sudo apt install ./*.deb
sudo systemctl restart php$X-fpm      # and/or apache2 when PHP runs as mod_php

Note: these packages are not built or endorsed by Sury. The packages are unsigned. Test on staging before applying to production.

CentOS 7 Remi php73 7.3.33-23.sizlon1 (PHP2Shell)

Superseded (2026-10-29) by el7-php73-7.3.33-24.sizlon1. Remi 7.3.33-24 now includes the handler reset this release added as Patch236, so 24.sizlon1 is Remi's source rebuilt unchanged. The code is the same and these RPMs remain safe to run; new installs should use 24.sizlon1, which upgrades this release in place with yum.

Unofficial rebuilt RPMs for CentOS 7 + Remi php73. Supersedes the earlier release el7-php73-7.3.33-22.sizlon1.

• Base: Remi php-7.3.33-23.remi.src.rpm (published for EL8/EL9 only). It includes the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619) and two SOAP fixes (CVE-2026-91765, CVE-2025-14181).
• Added: the shutdown-time handler reset that the Remi patch is missing (Patch236, same as the official php.net 7.4 fix)
• Version: 7.3.33-23.sizlon1.el7. In-place yum upgrade verified from the last Remi el7 build (7.3.33-14) and from the earlier 22.sizlon1.

Verification: reports/el7-remi-php73.md
Read before applying: EXPECTED-CHANGES.md
(session upload progress is disabled; a worker exits immediately when it runs out of memory → nginx 502)

Install

Run on the server. This downloads only the packages already installed there, checks them against SHA256SUMS and upgrades them in place. How to check the result and roll back: Installing the packages in the README.

TAG=el7-php73-7.3.33-23.sizlon1 VR=7.3.33-23.sizlon1
URL=https://github.com/ngenieer/php-eol-backports/releases/download/$TAG
mkdir -p ~/php-update && cd ~/php-update
curl -fsSLO "$URL/SHA256SUMS"
for p in $(rpm -qa 'php*' --qf '%{NAME}\n'); do
  f="$p-$VR.el7.x86_64.rpm"
  if awk -v f="$f" '$2 == f' SHA256SUMS | grep -q .; then
    curl -fsSLO "$URL/$f"; awk -v f="$f" '$2 == f' SHA256SUMS >> SHA256SUMS.mine
  else echo "not in this release: $p"; fi
done
sha256sum -c SHA256SUMS.mine          # every line must say OK
sudo yum localinstall ./*.rpm
sudo systemctl restart php-fpm        # and/or httpd when PHP runs as mod_php

Note: these packages are not built or endorsed by php.net or Remi. The RPMs are not GPG-signed. Test on staging before applying to production.

CentOS 7 Remi php73 7.3.33-22.sizlon1 (PHP2Shell backport)

Superseded (2026-10-26): these RPMs were built before the handler reset placement in the 7.3 patch was fixed. The RPMs have been removed from this release. Use el7-php73-7.3.33-23.sizlon1 instead; servers running 22.sizlon1 upgrade to it in place with yum.

This page is kept for reference. It was an unofficial RPM rebuild for CentOS 7 + Remi php73.

• Base: Remi php-7.3.33-22.remi.src.rpm (includes the latest security fixes, published for EL8/EL9 only)
• Added: PHP2Shell (CVE-2026-109618, CVE-2026-109619) backport (Patch234)
• Version: 7.3.33-22.sizlon1.el7

Details: reports/el7-remi-php73.md, reports/sury-crosscheck.md