Beta Branch backport PHP 8.2.35 security fixes to PHP 7.4-8.1 EOL in 140.00beta01

backport PHP 8.2.35 security fixes to PHP 7.4-8.1 EOL in 140.00beta01

Backport the fix for CVE-2026-109618 and CVE-2026-109619 (critical, unauthenticated RCE), released in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, to EOL PHP 7.4, 8.0 and 8.1. It is the PHP security team's minimal EOL mitigation "Avoid state corruption via bailout", one patch per version covering both CVEs. PHP 7.2 and 7.3 have no backport yet. Also bump the installer PHP fallbacks to the new releases.

Changes:
- patches/php: add php742-7.4-cve-2026-109618.patch, php80-8.0-cve-2026-109618.patch and php81-8.1-cve-2026-109618.patch (GHSA-w8hw-w9fx-j79w RCE via OOM corruption, GHSA-6wmf-4rv5-p3rp RCE via stale global state)
- inc/php_patch.inc: append 7.4-cve-2026-109618, 8.0-cve-2026-109618 and 8.1-cve-2026-109618 to the PHP 7.4, 8.0 and 8.1 lists
- inc/php_patch.inc: for PHP 8.1, touch the generated Zend VM files after patching so make keeps the patched zend_vm_execute.h instead of rerunning zend_vm_gen.php with the installed PHP, which fails when that PHP is 8.5
- installer82.sh: PHPVERLATEST fallback 8.2.34 to 8.2.35
- installer83.sh: PHPVERLATEST fallback 8.3.35 to 8.3.36
- installer84.sh: PHPVERLATEST fallback 8.4.26 to 8.4.27
- installer85.sh: PHPVERLATEST fallback 8.5.11 to 8.5.12

---

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01