Beta Branch backport PHP 8.2.35 security fixes to PHP 7.2-7.3 EOL in 140.00beta01

backport PHP 8.2.35 security fixes to PHP 7.2-7.3 EOL in 140.00beta01

---

Backport the fix for CVE-2026-109618 and CVE-2026-109619 (critical, unauthenticated RCE), released in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, to EOL PHP 7.2 and 7.3. The PHP security team published its minimal EOL mitigation "Avoid state corruption via bailout" for 7.4, 8.0 and 8.1 only, so these are Centmin Mod ports of upstream commit 712e60f9edfd from the PHP-7.4-CVE-2026-109618-109619 branch. They keep the 7.4 behaviour: exceeding memory_limit now ends the PHP process or PHP-FPM worker, and session upload progress is disabled. Each patch header lists its adaptations to the older code.

Changes:
- patches/php: add php7331-cve-2026-109618.patch (PHP 7.3.33) and php7234-cve-2026-109618.patch (PHP 7.2.34) (GHSA-w8hw-w9fx-j79w RCE via OOM corruption, GHSA-6wmf-4rv5-p3rp RCE via stale global state)
- inc/php_patch.inc: append cve-2026-109618 to the PHP 7.2 and 7.3 lists

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01