PHP 7.1 Security Patches for CentOS 6
Everpatch PHP keeps PHP 7.1 security-patched on CentOS 6 — an in-place update for Remi's el6 remi-php71 packages.
Signed RPM builds, drop-in compatible with Remi's el6 packages, with current security fixes ported to the 7.1 codebase. Package names stay the same; yum update replaces them in place.
PHP2Shell fixed from 7.1.33-40.el6. How to apply it · Check your server
The gap
PHP 7.1 has been end of life upstream since the end of 2019, and CentOS 6 went end of life in November 2020. Every PHP security release since then has skipped both the version and the OS.
Everpatch PHP 7.1 carries the same security stack as the CentOS 7 channel, built for EL6: the upstream php-src fixes ported to 7.1, signed and served from extras.getpagespeed.com.
Install
Upgrading Remi remi-php71 in place (base-name php-*)
yum -y install https://extras.getpagespeed.com/release-latest.rpm yum --enablerepo=getpagespeed-extras-php71 update 'php*' service php-fpm restart # or: service httpd restart php -v
On a fresh host, swap update 'php*' for install php-cli php-fpm plus the extensions you need; no EPEL is required. Enable the channel per transaction as shown: it carries base-name php, so leaving it on would offer that version to an unscoped yum update.
Package names match Remi's el6 remi-php71 packages, so the update is in place, and the PECL extensions you already run keep loading (same PHP API and ABI). CentOS 6 builds are base-name php-* only, with no software collection. Running Apache mod_php? Restart httpd. Afterwards php -v prints Built by GetPageSpeed LLC.
Free for personal use. Running it for a business?
Patching EOL PHP is ongoing work: every new PHP CVE has to be ported to branches upstream abandoned years ago, then built and tested on EL6. Commercial production use requires GetPageSpeed Ultra or GetPageSpeed Fleet: either one funds that work and keeps your production servers covered for the next one, together with the full GetPageSpeed repository. Ultra covers up to 10 servers running your own services; Fleet is the plan for servers that host client websites, or for more than 10 servers. 250+ employees or $10M+ revenue, or need a contractual SLA and invoice/PO? That is Enterprise.
Ultra, $500/year Fleet, from $800/year Contact us about Enterprise
Security fixes in this channel
The channel's security notes track 61 CVE fixes and 13 further GitHub security advisories that never reached the last vendor build for Enterprise Linux 6.
Fixes are ports of the upstream php-src security patches, audited hunk by hunk; the provenance of every patch is documented per release.
Frequently asked questions
Is PHP 7.1 on CentOS 6 patched for PHP2Shell?
Yes. Everpatch PHP 7.1 carries the backported PHP2Shell fix from 7.1.33-40.el6 onward. The PHP version number does not change, so check the package release rather than php -v, or paste your package list into the PHP2Shell checker. The full walkthrough is in our PHP2Shell guide.
Is PHP 7.1 still safe to run on CentOS 6?
With this channel, the publicly known PHP CVEs that apply to 7.1 are patched — years after upstream stopped. PHP 7.1 remains an end-of-life runtime on an end-of-life OS: plan your upgrade on your own schedule. Everpatch exists so a CVE disclosure does not set that schedule for you.
Where do the patches come from?
From upstream php-src, ported to the 7.1 source tree and audited hunk by hunk. CentOS 6 and CentOS 7 builds share one patch stack; every patch's provenance is documented per release.
Will this replace my existing PHP packages?
Yes, in place. The channel ships the same base-name php-* package names as Remi's el6 remi-php71 repository, in the getpagespeed-extras-php71 channel, with higher release numbers, so yum update swaps them. Your Remi el6 PECL extensions keep loading.
Is oci8 (Oracle) available on CentOS 6?
Yes: php-oci8 is built against Oracle Instant Client 18.5, the newest client Oracle published for Enterprise Linux 6. Install Oracle Instant Client 18.5 from Oracle first: the GetPageSpeed repository does not redistribute Oracle's libraries.
Do I need a subscription?
Not for personal, development or evaluation use: the PHP packages install from the public GetPageSpeed repository with no signup. Commercial production use requires a subscription under the repository terms: GetPageSpeed Ultra ($500/year) for up to 10 servers running your own services, or GetPageSpeed Fleet (from $800/year) for servers that host client websites or fleets larger than 10. Either one funds these backports and keeps your servers covered for the next EOL PHP CVE. Organizations with 250+ employees or $10M+ revenue, or anyone needing a contractual SLA and invoice/PO procurement, should contact us about Enterprise. To license servers without registering IP addresses, place your license file at /etc/getpagespeed/license.jwt.