PHP 5.3 Security Patches for CentOS 6
Everpatch PHP keeps the PHP 5.3 that CentOS 6 shipped by default security-patched — a drop-in update for the stock php-5.3.3 packages.
Signed RPM builds of the stock CentOS 6 PHP 5.3.3 with current security fixes hand-ported to the 5.3 codebase. Same package names, same extension ABI and the same /etc/php.d layout, so yum update replaces them in place.
PHP2Shell fixed from 5.3.3-51.el6. How to apply it · Check your server
The gap
PHP 5.3 was the default PHP of CentOS 6. Upstream PHP 5.3 ended in 2014 and CentOS 6 went end of life in November 2020, so the stock php-5.3.3 packages stopped receiving fixes, while years of PHP security releases kept landing on newer branches only.
Everpatch PHP 5.3 keeps every stock CentOS 6 patch and adds the fixes CentOS 6 never received, from the 2015-2021 backlog to the current PHP security releases, PHP2Shell included: each one ported to the 5.3 engine and audited against upstream and this project's 5.4 ports.
Install
Upgrading stock CentOS 6 PHP 5.3 in place (php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum update 'php*' service httpd restart # or: service php-fpm restart php -v
The packages carry the stock CentOS 6 names (php, php-cli, php-common, php-mysql, ...) with higher release numbers and live in the base GetPageSpeed repository, so no channel needs enabling: yum update replaces the stock php-5.3.3 in place and keeps your php.ini and /etc/php.d edits. Hosts already on a PHP 5.4 or newer build are never offered them.
Extensions built for stock CentOS 6 PHP keep loading: the PHP API, Zend extension ABI and configure flags are unchanged. Afterwards php -v prints Built by GetPageSpeed LLC.
Free for personal use. Running it for a business?
Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on EL6. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.
Ultra, $500/year Fleet, from $800/year Contact us about Enterprise
Security fixes in this channel
The channel's security notes track 109 CVE fixes and 8 further GitHub security advisories that never reached the last vendor build for Enterprise Linux 6.
Fixes are ports of the upstream php-src security patches, audited hunk by hunk; the provenance of every patch is documented per release.
Frequently asked questions
Is PHP 5.3 on CentOS 6 patched for PHP2Shell?
Yes. Everpatch PHP 5.3 carries the backported PHP2Shell fix from 5.3.3-51.el6 onward. The PHP version number does not change, so check the package release rather than php -v, or paste your package list into the PHP2Shell checker. The full walkthrough is in our PHP2Shell guide.
Does it work with the stock CentOS 6 PHP packages?
Yes, that is what it is built for. It ships the same package names as stock CentOS 6 PHP (php, php-cli, php-common, php-mysql, php-gd, ...) with the same configure flags, extension ABI and configuration paths. After installing the release package, yum update 'php*' replaces php-5.3.3 with the patched build; your php.ini and php.d edits are kept.
Is PHP 5.3 still safe to run on CentOS 6?
Safer with this channel than without it: the publicly known PHP vulnerabilities that apply to 5.3 are being patched here, years after upstream and CentOS stopped. PHP 5.3 remains an end-of-life runtime on an end-of-life OS — plan your upgrade on your own schedule. Everpatch exists so a CVE disclosure does not set that schedule for you.
What if I would rather move to a newer PHP?
On CentOS 6, the PHP 7.0 and PHP 7.1 channels are security-patched the same way. For a 5.3-era codebase that is usually a porting project — until it happens, this channel keeps the known holes closed.
Do I need a subscription?
Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise. To license servers without registering IP addresses, place your license file at /etc/getpagespeed/license.jwt.