Amazon Linux 2 PHP 7.4 / 8.0 / 8.1 / 8.2 self-build RPMs, plus non-AL2 PHP 7.4 / 8.0 / 8.1 FPM container images.
Existing separate-prefix AL2 7.4/8.0/8.1/8.2 RPMs and non-AL2 FPM 7.4/8.0/8.1 images are published after bounded checks. All three registry images passed anonymous digest pulls. The newer AWS-layout 7.4/8.0/8.1 complete split-RPM rebuilds are now published as unofficial x86_64 prereleases; see the verified release links and limitations below, and the recipe scope and QA gates. For system-layout 8.2, prefer AWS official 8.2.35, not a custom 8.2.34 backport.
License scope, bundled notices and verification status are explicit in LICENSE-NOTICE.md. Repository MIT does not relicense PHP, Zend, extensions or OS/image layers.
For PHP 7.4/8.0/8.1, this project packages the PHP project's minimal EOL mitigations for CVE-2026-109618 and CVE-2026-109619. It does not restore upstream support, fix every known vulnerability, or make Amazon Linux 2 or old Debian releases supported. Upgrade to maintained PHP and OS versions as soon as possible.
- Existing independent-prefix RPMs and official-base FPM images: immutable published artifacts below. AL2 8.2: published limited-prefix build.
- AWS SRPM/spec-layout rebuilds: full 7.4/8.0/8.1 split sets are published below as unofficial prereleases. Vendor configuration is retained, with the security patch, local Release suffix and explicitly documented build-only SDK preparation differences. This family replaces matching system PHP packages rather than installing in /opt.
- AWS official 8.2.35 is preferred for normal AL2 8.2 packages.
These unsigned, unofficial x86_64 packages use normal AWS package names/paths and replace the matching installed system PHP cohort. They are not Amazon-signed or Amazon/PHP-supported releases. Do not mix series or install every optional subpackage solely because it is available.
- PHP 7.4: 28 normal subpackages + debuginfo + complete SRPM; 51 uploaded assets.
- PHP 8.0: 26 normal subpackages + debuginfo + complete SRPM; 49 uploaded assets.
- PHP 8.1: 26 normal subpackages + debuginfo + complete SRPM; 49 uploaded assets.
The immutable build recipe is b6ec0b470040e432b7a8e5cff404f3c8e54c93c8. Trusted-main build, QA and publication run39743088760 passed all three series after the reviewed PR QA. Each release contains source/spec diffs, SBOM, provenance, SHA256SUMS, original PHPT and transaction/runtime evidence, and version-matched license notices.
The original official PHPT results are retained, not relabeled all-tests-pass:
- 7.4: 9124 PASS / 12 FAIL / 6616 SKIP / 33 XFAIL / 0 WARN.
- 8.0: 9593 PASS / 11 FAIL / 6862 SKIP / 28 XFAIL / 1 WARN.
- 8.1: 10287 PASS / 15 FAIL / 7372 SKIP / 8 XFAIL / 0 WARN.
Exact source-bound intentional/fixture differences were reviewed; unknown differences block publication. Additional isolated-container checks covered official-cohort upgrade/config preservation and saved-original RPM rollback, packaged SAPIs/modules, the targeted vendor PECL set, headers/API/ELF and bounded TLS/upload/session/OOM behavior. Systemd unit activation, production applications, arbitrary private extensions and full FIPS compatibility remain unverified. Rolling back to original RPMs restores known vulnerabilities.
All 149 uploaded assets passed the publishing job's local-byte/API size-and-digest checks. After publication, all 86 RPM API SHA256 values matched the main job's tested final set in independent review. Anonymous API metadata and logged-out public release pages were reachable. Independent anonymous binary re-download and re-hashing were not completed; do not interpret metadata visibility as that stronger test.
For 7.4/8.0, authenticated old SDK headers only are staged in the private build environment to retain original registered API values; no old runtime libraries are installed. This is an explicit difference beyond the security patch and Release suffix. Complete SDK inputs/helper/lock are included in the SRPM. The official EOL mitigation's OOM/shutdown and builtin upload-progress tradeoffs remain; see the recipe and release notes. Checksums are not a publisher signature; do not weaken package-signature policy to install unsigned builds. Use the site's existing approved review/rebuild/signing process.
- Fixed complete upstream source trees, not a partial patch selection.
- The previously published minimal AL2 packages use a separate prefix and package names. They do not replace AWS PHP RPMs, system libraries, handlers, PATH, services, configuration or sockets.
- RPM/SRPM and FPM container results are tracked separately for each version and CPU.
- Initial CPU target is x86_64 / linux/amd64 only.
- No production service starts automatically.
- No new signing keys, personal access tokens, self-hosted runners or paid infrastructure.
- Old official images are only compatibility inputs, not patched images.
- Applications relying on session upload-progress callbacks or OOM shutdown handlers must be retested. These behaviors deliberately change.
See sources.lock.json. PHP 7.4: 712e60f9edfd03f0960fc4fc3c2c375f42b90aa2; PHP 8.0: 82f8f31b16a035c1b67cc253e79f7cc288f4cc20; PHP 8.1: 1d7dec178a094e6e75b229ce22754045f8c6070a.
Official announcement, PHP source licensing.
A version string or a successful compile alone does not prove mitigation. Source SHA, generated source archive checksum, recipe commit, binary/package/image digest, and recorded runtime tests must be read together.
The two deliverables are separate:
- Amazon Linux 2 native x86_64 RPM/SRPM packages.
- Non-AL2 Docker images derived from the historical official
php:7.4-fpm,php:8.0-fpm, andphp:8.1-fpmimages, each pinned by digest. PHP 7.4 and 8.0 use their Bullseye-era inputs; 8.1 uses its Trixie-era input. These are not Amazon Linux images.
Build shell scripts under al2/ are disposable-container recipes. Never execute them directly on a production host. The CI wrapper installs build tools only in a disposable container, compiles as an unprivileged builder, stages installation with INSTALL_ROOT, then installs/tests the RPM in a different fresh AL2 container. No host Docker socket is mounted inside the build container.
CI is limited to standard public GitHub-hosted runners. Pull-request/manual verification is read-only. Trusted main pushes run independent per-series publish jobs: build, test, then publish those same artifacts immediately if every local gate passed. A failure in another series does not block a successful one. Publication uses only the repository-scoped, job-lifetime GITHUB_TOKEN in the publication step, not a PAT or new signing key. A final-head check runs before each external write.
These packages are deliberately not binary-compatible replacements for every AWS PHP package or PECL extension. Their minimal native configuration includes CLI, FPM, OPcache, curl/OpenSSL, sockets, bcmath, SQLite, mysqlnd/mysqli/PDO MySQL. Existing extensions, php.ini, application handlers, cron/queue commands and web-server sockets require an explicit application-specific migration. Do not copy old .so modules blindly.
Each RPM installs under /opt/php-mitigation/SERIES-SOURCE8-BUILD_ID, with independent /etc/php74-mitigation, /etc/php80-mitigation, or /etc/php81-mitigation configuration. It does not enable or start FPM. Default socket access is intentionally restricted; choose the application user/group before service activation.
Updating the same RPM package name may remove the previous prefix. A build-ID path is provenance, not a guarantee that an old RPM stays installed alongside the new one.
- Download a version-specific Release's binary RPM, SRPM, rendered spec, SHA256SUMS, provenance and test records.
- Verify SHA256SUMS against the trusted repository/Release commit and inspect the package contents/dependencies before installation. Checksums provide integrity, not a cryptographic publisher signature.
- These initial independent RPMs are unsigned. Do not weaken
gpgcheck, import an unverified key or enable an unsigned yum repository. Sites requiring signed packages should review and rebuild/sign the SRPM using their existing approved process. - On an isolated clone of the application host, install the reviewed local RPM using the site's normal package policy, inspect the absolute binary path and configuration, and run application/session/upload/TLS/DB/queue/OPcache tests.
- Test FPM with its own service, master process and socket, then deliberately switch the web-server handler and cron/queue commands. A second pool in the old master is not a new PHP engine.
- Before an update, save the current RPM, configuration and handler settings, plus an application/data rollback plan. Review
.rpmnewfiles after upgrade. No service is auto-restarted by the package. - Rollback requires reinstalling the saved prior RPM and restoring matching configuration/handler/extension paths, followed by controlled master/worker/queue restart. The old binary may be vulnerable; rollback is an incident decision, not a safe default.
A signed versioned yum repository is deferred until an existing approved signing identity is supplied. GitHub Releases is the initial distribution route; no Cloudflare account or billing changes are necessary.
The legacy 7.4/8.0/8.1 bounded gates cover compilation, CLI data handling, deliberate OOM exit without a shutdown callback, install-time dependency resolution, FPM config, OPcache loading, session requests in the same worker, ordinary multipart upload, and replacement of an OOM-killed worker. The separate 8.2 profile is described below.
They do not prove exploit resistance, execute the full upstream suite, test every extension/application, or directly prove that upload-progress callbacks are absent at runtime. Complete fixed-tree provenance is recorded separately. No ARM/multi-architecture claim is made.
Bullseye security packages moved to the official Debian archive after Debian 11 LTS ended on 2026-08-31. The 7.4/8.0 recipes use that official archive without disabling signature verification or date validation. This is frozen historical dependency availability, not continuing security support. See Debian notice.
SBOM generation uses upstream Anchore Syft 1.55.0, verified against the pinned official release-asset SHA256. Build provenance JSON is descriptive evidence, not a new cryptographic signing identity or a security certification.
Do not publish FastCGI port 9000 directly to the Internet. EXPOSE is documentation, not a request to publish that port. Use an isolated private container network or a Unix socket and an appropriately restricted web-server frontend. CI binds its test port only to 127.0.0.1.
The patched source is a Git tree, not a newly signed official PHP release tarball. The final image clears inherited PHP_URL, PHP_ASC_URL and PHP_SHA256 release-download values. PHPMITIGATION_SOURCE_SHA and PHPMITIGATION_SOURCE_ARCHIVE_SHA256 identify the rebuilt tree/archive; OCI revision identifies this repository's recipe commit. PHP_VERSION is aligned with the generated binary's source version, but is not proof of mitigation.
PEAR installation is not re-run from the network during rebuilding. Inherited PEAR/PECL tools from the pinned official base are not promoted as newly rebuilt components. Rebuild and compatibility-test additional extensions against the fixed source and the exact resulting image; do not mount an old extension directory or OPcache file cache.
The AL2 FPM smoke test does not start systemd inside a container. It validates the packaged FPM configuration syntax, then runs a dedicated test-only TCP configuration. Systemd unit activation, the packaged Unix socket, real-host RuntimeDirectory behavior and an application's actual handler remain deployment-site tests.
Additional bounded runtime checks exercise OpenSSL digest/randomness, curl version lookup, in-memory PDO SQLite and actual OPcache compile/cache lookup. Docker additionally tests mbstring/sodium and inherited PEAR/PECL version commands; AL2 additionally tests bcmath/mysqli availability. These are local functional checks, not a live DB/TLS integration test.
The historical official 7.4/8.0 FPM images shipped OPcache disabled; these images preserve that default. CI enables the rebuilt module only in a dedicated test process and separately exercises an OPcache-disabled FPM configuration. Default inherited and rebuilt module inventories must match. The 8.1 image preserves its original enabled default.
日本語の パッチ適用の確認方法と証跡 を参照してください。バージョン文字列だけでなく、完全な固定 source SHA と実行バイナリ/成果物の checksum を照合できます。
AL2 PHP 8.2 is built from the normal official PHP 8.2.35 security release, not an EOL minimal-mitigation branch. Its official distribution SHA256 and allowed signing fingerprints are pinned in sources.lock.json; CI verifies both the downloaded archive hash and its detached GPG signature before building.
Package php82-security uses /opt/php-security/8.2-SOURCE8-BUILD_ID and independent /etc/php82-security configuration. It still does not turn EOL Amazon Linux 2 into a maintained OS.
The normal 8.2 security fix has different OOM/session behavior. Its dedicated profile expects ordinary memory_limit failure status 255 and the shutdown callback, then checks FPM remains healthy; it does not require killing/replacing that worker or disabling upload-progress callbacks. Legacy 7.4/8.0/8.1 profiles retain their distinct exit-1/no-shutdown/replacement expectations. A malloc/system-wide OOM is a different failure mode.
There is no Docker 8.2 artifact in this request. The distribution matrix has four AL2 native versions and three non-AL2 FPM images.
The AL2 8.2 builder selects the official openssl11-devel package instead of installing both conflicting development header sets. Build-local pkg-config aliases resolve openssl/libssl/libcrypto to the installed *11.pc metadata; the effective version/flags and RPM file list are recorded. No global metadata or symlinks are changed. Runtime uses versioned openssl11-libs alongside the pre-existing openssl-libs; CI requires the old runtime package and /usr/bin/openssl hash/presence to remain unchanged. The system OpenSSL is not replaced. The signed original 8.2 tar.xz and detached .asc are also Release assets.
The verified 7.4/8.0/8.1 artifacts are available now:
- AL2 PHP 7.4 RPM/SRPM
- AL2 PHP 8.0 RPM/SRPM
- AL2 PHP 8.1 RPM/SRPM
- Official-base FPM 7.4 image/evidence
- Official-base FPM 8.0 image/evidence
- Official-base FPM 8.1 image/evidence
Public registry tags are ghcr.io/g-kari/php-image:7.4-fpm-cve2026-3e399dfb0453, 8.0-fpm-cve2026-3e399dfb0453, and 8.1-fpm-cve2026-3e399dfb0453 under the same image name. Prefer the immutable digest in each Release's IMAGE.txt. Recovery verification run rechecked all delivered asset bytes; FPM anonymous digest pulls matched the tested image IDs, source SHAs and binary checksums. AL2 recovery reinstalled and retested the original RPM bytes without rebuilding. Original uploaded evidence is retained where replacement evidence was needed. These remain the official EOL minimal-mitigation builds described above, not general full-fix/support claims.
AL2 8.2 is published only after its separate build/runtime/publication gates pass. The initial OpenSSL 1.0.2 build did not pass; the 8.2-only follow-up selects the official parallel OpenSSL 1.1 provider. The maintenance commit marker [al2-8.2-only] limits that follow-up to AL2 8.2 rather than rebuilding these six unchanged artifacts; it does not bypass any gate for the selected artifact.
PHP's OpenSSL extension uses the versioned 1.1 libraries; the AL2 system libcurl retains its historical 1.0.2 backend. The linker reports that coexistence. Before publication, CI inspects the actual CLI/FPM/libcurl/provider ELF symbols and rejects unversioned, ambiguous or cross-provider OpenSSL references. It records object paths/hashes, dynamic dependencies and version tables. Two fresh PHP processes exercise curl→OpenSSL stream→curl and the opposite initialization order against the single public PHP HTTPS origin, with standard CA trust, strict certificate/hostname checks, bounded timeouts, no credentials/cookies, and no redirect following. These checks do not certify arbitrary extension ABI, FIPS status, proxies or all TLS/application combinations. No old runtime library or global OpenSSL setting is replaced.