Stable Branch backport PHP 8.2.35 security fixes to PHP 7.2-7.3 EOL in 132.00stable

Hello, I have a server with php 7.2.34

I did:

Code:

cmupdate
centmin option 5
upgrade to 7.2.34

after that I still get:

Code:

bash php-eol-cve-2026-109618-check.sh
CVE-2026-109618 / CVE-2026-109619 check
PHP binary    : /usr/local/bin/php
PHP version   : 7.2.34
PHP_VERSION_ID: 70234

A. OOM bailout (shutdown fn)       VULNERABLE   shutdown function ran after OOM (exit 255, OOM msg on stdout)
B. session upload progress         VULNERABLE   $_SESSION has upload_progress_cmmpoc after upload
C. Centmin patch log (info)        INFO         patch_php_211026-230307.log (last Centmin PHP 7.2 build, not necessarily this binary): Patch applied successfully for cve-2026-109618

 

yesterday was saying that there was no updates, today as there are new updates is saying this:

Code (Text):

cmupdate

-------------------------------------
Updating Centmin Mod code
-------------------------------------

* 132.00stable
Checking for updates on origin/132.00stable ...
From https://github.com/centminmod/centminmod
 * branch            132.00stable -> FETCH_HEAD
Fast-forwarding 132.00stable to origin/132.00stable ...
Updating fb9d9b8..ee9ca53
Fast-forward
 centmin-cli.sh              | 43 ++++++++++++++++++++++++++++++++-----------
 centmin.sh                  | 43 ++++++++++++++++++++++++++++++++-----------
 inc/brotli.inc              | 12 +++++++++++-
 inc/cpcheck.inc             | 26 ++++++++++++++++++++++++++
 inc/git_sync.inc            | 12 ++++++++++++
 inc/openssl_install.inc     | 10 ++++++++++
 inc/php_patch.inc           |  3 ++-
 inc/zendopcache_upgrade.inc | 14 ++++++++++++++
 tools/iconv-fixes.sh        | 12 ++++++++----
 9 files changed, 147 insertions(+), 28 deletions(-)
Updated to ee9ca53 fix PHP 7.3 pcre1038 patch applied twice in 132.00stable.
Already up-to-date!
Latest commit: ee9ca53 (2026-10-22)
    fix PHP 7.3 pcre1038 patch applied twice in 132.00stable

-------------------------------------
Updated Centmin Mod code
-------------------------------------

I'm going to try again option 5 and rebuild 7.2.34

 

I tried like in another server I upgraded to switch repositories to from vault.centos.org to archive.kernel.org/centos
and then tried another upgrade (rebuild) to 7.2.34

this is the upgrade log:
https://gist.githubusercontent.com/kintaro1981/d044442c98dfe71052bec1832f71c683/raw/d530c0ef4815bba23ee27c46994e55aed5f4708b/php%20upgrade.log

this is the patch log:
https://gist.github.com/kintaro1981/4a1019ca67d21dc67ba8756a612019a3

I can't see any error that can make it fail, it seems ok but I get:

Code (Text):

bash php-eol-cve-2026-109618-check.sh
CVE-2026-109618 / CVE-2026-109619 check
PHP binary    : /usr/local/bin/php
PHP version   : 7.2.34
PHP_VERSION_ID: 70234

A. OOM bailout (shutdown fn)       VULNERABLE   shutdown function ran after OOM (exit 255, OOM msg on stdout)
B. session upload progress         VULNERABLE   $_SESSION has upload_progress_cmmpoc after upload
C. Centmin patch log (info)        INFO         patch_php_211026-230307.log (last Centmin PHP 7.2 build, not necessarily this binary): Patch applied successfully for cve-2026-109618

Overall: VULNERABLE

 

I solved now upgrading to 7.3.33.

Code (Text):

bash php-eol-cve-2026-109618-check.sh
CVE-2026-109618 / CVE-2026-109619 check
PHP binary    : /usr/local/bin/php
PHP version   : 7.3.33
PHP_VERSION_ID: 70333

A. OOM bailout (shutdown fn)       PATCHED      no shutdown function, OOM msg on stderr, exit 1
B. session upload progress         PATCHED      no upload_progress_ key in $_SESSION after upload
C. Centmin patch log (info)        INFO         patch_php_221026-154631.log (last Centmin PHP 7.3 build, not necessarily this binary): Patch applied successfully for cve-2026-109618

Overall: PATCHED

I'm going to try if the website is compatible with it hoping to have the green light to finally update it and leave php7 in the dust.