v1.0.0

Initial public release of unofficial minimal backports for
CVE-2026-109618 and CVE-2026-109619.

Patches

PHP	Files changed	Patch
5.4.33	10	patches/php-5.4.33/
5.6.7	10	patches/php-5.6.7/
7.1.1	15	patches/php-7.1.1/
7.3.13	15	patches/php-7.3.13/

Each directory contains the patch, a source manifest with before/after
SHA-256 hashes, and per-file checksums. The patches apply to the exact
official release archives listed in the README.

Verification

All four versions were built on macOS arm64 (NTS) and passed the shared
suite: 16/16 CLI/CGI smoke checks, 3/3 allocator failure probes, and 4/4 FPM
worker isolation/OOM recovery checks. Selected upstream PHPT files also
passed; see docs/testing.md for the exact scope and the checks that were
not performed.

Important limitations

These patches are not a complete fix and are not a substitute for upgrading.
The vulnerabilities are fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Out-of-memory on covered paths terminates the process, session upload
progress is disabled, and the multipart parser gains new limits. Linux
production builds, Apache mod_php, ZTS, third-party extension sets and
sanitizers were not tested. Read the "What these patches do not do" section
of the README and docs/limitations.md before deploying.

License

Patch files are derivative works of PHP and are distributed under the PHP
License 3.01. See LICENSE and NOTICE.