Scalable Stories

PHP2Shell on CentOS 7: Patched PHP 5.6 to 8.4

Play Episode Pause Episode

1x

00:00 / 00:12:04

Apple Podcasts

RSS Feed

Share

Link

Embed

<blockquote class="wp-embedded-content" data-secret="w0cNuhaXea"><a href="https://www.getpagespeed.com/podcast/php2shell-on-centos-7-audio">PHP2Shell on CentOS 7: Patched PHP 5.6 to 8.4</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://www.getpagespeed.com/podcast/php2shell-on-centos-7-audio/embed#?secret=w0cNuhaXea" width="500" height="350" title="&#8220;PHP2Shell on CentOS 7: Patched PHP 5.6 to 8.4&#8221; &#8212; GetPageSpeed" data-secret="w0cNuhaXea" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script> /*! This file is auto-generated */ !function(d,l){"use strict";l.querySelector&&d.addEventListener&&"undefined"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),o=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]'),c=new RegExp("^https?:$","i"),i=0;i<o.length;i++)o[i].style.display="none";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute("style"),"height"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):"link"===t.message&&(r=new URL(s.getAttribute("src")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",function(){for(var e,t,s=l.querySelectorAll("iframe.wp-embedded-content"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute("data-secret"))||(t=Math.random().toString(36).substring(2,12),e.src+="#?secret="+t,e.setAttribute("data-secret",t)),e.contentWindow.postMessage({message:"ready",secret:t},"*")},!1)))}(window,document); //# sourceURL=https://www.getpagespeed.com/wp-includes/js/wp-embed.min.js </script>

Technical Briefing: Patched PHP 5.6–8.4 for CentOS 7 Against PHP2Shell

Today’s source is a GetPageSpeed article about PHP2Shell on CentOS 7. A recent briefing covered GetPageSpeed’s free patched PHP 7.4 for Ubuntu 20.04. This article covers the CentOS 7 side, which is broader: GetPageSpeed now publishes patched builds for every PHP branch from 5.6 through 8.4. They are distributed as per-version channels for base-name packages and as software collections, and they install in place over Remi packages.

Recap: PHP2Shell

The vulnerabilities were covered in the Ubuntu 20.04 briefing. In brief:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), CVSS v4.0 9.2, is RCE via out-of-memory corruption.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), CVSS v4.0 9.2, is RCE via stale global state.

Both are unauthenticated. They were published by the PHP security team on October 21, 2026, after a pre-announcement the day before.

• Affected: PHP 5.4 and later, on all web SAPIs (PHP-FPM, mod_php, php-cgi, LiteSpeed, FrankenPHP).
• Worst case: mod_php, because a demonstrated exploit fires before any application code runs.
• Exploitation: Tenable reports broad in-the-wild exploitation. Amazon honeypots saw an attempt four days before disclosure.
• Upstream fixes:
  • Released only in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • 7.4, 8.0 and 8.1 got minimal source-only backports.
  • 7.3 and older got nothing.

Why CentOS 7 Is Stuck

• No more Remi updates. Remi stopped building for EL7 in June 2024. Its EL7 builds froze at 8.1.29, 8.2.20 and 8.3.8, so yum update never delivers a fix, even on 8.2 and 8.3.
• php.net’s advice. On release day, php.net told Remi users to build from source.
• Few alternatives. The article says GetPageSpeed is the only source of a fixed PHP for CentOS 7. The other options it lists are a hand-ported source rebuild, a commercial vendor with different package names and paths, or staying exposed.

Interim Mitigations Are Only Partial

The advisory lists three stopgaps: memory_limit=-1, a low post_max_size, and session.upload_progress.enabled=0. None of them closes both holes:

• Removing the memory limit still lets real allocation failures reach the vulnerable path.
• Disabling upload progress blocks only one confirmed path for CVE-2026-109619 and does nothing for CVE-2026-109618.

The PHP team states that only an update is a complete fix.

Applying the Fix

1. Identify your package shape:

rpm -qa 'php*-common' --qf '%{NAME}-%{VERSION}-%{RELEASE}\n'

Any release ending in .el7.remi is vulnerable.

2a. Base-name packages replace the system PHP. An example is php-common-7.4.33-15.el7.remi from remi-php74.

yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum --enablerepo=getpagespeed-extras-php74 upgrade 'php-*'
systemctl restart php-fpm

• Replace php74 with your version: php56, php70, php71, php72, php73, php80, php81, php82 or php83.
• Enable the channel only for this transaction, as shown. Each channel carries base-name PHP of its own version.

2b. Software collections are packages such as php74-php-common-7.4.33-15.el7.remi from remi-safe. These builds live in the always-enabled main repository, so no channel is needed.

yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum upgrade 'php74-php*'
systemctl restart php74-php-fpm
scl enable php74 -- php -v

Replace php74 with your version (php56 through php84) in all four places.

3. Restart and verify:
– On Apache mod_php, restart httpd instead of PHP-FPM.
– php -v should print Built by GetPageSpeed LLC under the copyright line.
– rpm -qa should show a GetPageSpeed release, e.g. php-common-7.4.33-35.el7 or php82-php-common-8.2.35-2.el7.

Other platforms: A PHP2Shell checker accepts a pasted package list, understands distro backports, and gives the fix for every platform. Ubuntu 20.04 has its own guide.

Patched Builds and Fix Sources

Compatibility and Extras

• Drop-in replacement: Packages keep Remi names, ABI and library SONAMEs, so yum upgrade swaps them in place. PECL extensions and ionCube Loader keep working without a rebuild.
• PHP 8.4 collection: Remi never built 8.4 for EL7, so php84-php is GetPageSpeed’s own collection. scl enable php84 works the same way.
• Additional security fixes: The builds include the 2024–2026 fixes Remi published only for EL8 and newer.
  • For 5.6 through 7.3, the October 2026 security batch was also ported separately. It covers mysqlnd, OpenSSL hostname checks, SOAP, phar, stream filters, FastCGI ACLs and HTTP redirects.
• oci8 (5.6 to 8.3): Ships as php-oci8 and phpNN-php-oci8, linked against Oracle Instant Client 21.
  • You must install oracle-instantclient-basic 21.x from Oracle yourself, because the libraries are not redistributed.
• PHP 8.4 differences:
  • No oci8, since upstream removed it from core.
  • zip is the bundled extension (php-zip / php84-php-zip).
  • It links OpenSSL 3.5 LTS, ICU 74, libzip 1.11, libpq 17 and libxml2 2.13.

Validation

• Package tests: These run in a clean CentOS 7 container. Both PHP2Shell probes reproduce on the exact Remi package being replaced, then are proven fixed after the in-place upgrade. The harness also confirms:
  • the phpt suite shows no regressions beyond tests whose behaviour changes by design;
  • php -m lists identical modules, including PECL extensions and ionCube;
  • config files are preserved;
  • PHP-FPM keeps serving after an OOM request;
  • yum downgrade back to Remi works.
• Runtime tests: Real pages are served through every channel via both mod_php and PHP-FPM. Four scenarios are covered: fresh install, and upgrade from Remi with PECL and ionCube loaded, each for base-name and SCL. These tests run on every change and nightly against the published repository.
• Production use: First builds went live on October 22 on PrestaShop 1.6, Magento 1 and custom PHP 8.0 servers, with no downtime beyond a PHP-FPM restart.

Rollback and Caveats

• Rollback: yum downgrade returns you to Remi packages, with two exceptions:
  • For PHP 8.0 (either shape), the target is Remi’s 8.0.30-6, because 8.0.30-3 is no longer on Remi’s mirrors.
  • PHP 8.4 has no Remi build to return to, so rollback means going back to your previous PHP version.
• Behaviour change in backported branches (5.6 to 8.1): A request that hits memory_limit now ends its worker immediately. Shutdown functions don’t run, and buffered output isn’t sent.
  • The PHP security team made the same trade-off in its own EOL backports.
  • Code that catches memory exhaustion in a shutdown handler needs attention.
• CentOS 7 is still EOL: These channels patch only the PHP layer. Everpatch for CentOS 7 covers the rest, including a current LTS kernel. Migration should still be planned.

Licensing

• Free use: Available from the public repository with no signup, for personal, development or evaluation use.
• Commercial production use: Requires GetPageSpeed Ultra ($500/year, up to 10 servers). The subscription funds future EOL CVE backports and includes the full NGINX build and module repository for CentOS 7.

Practical Payoff

CentOS 7 servers on Remi PHP could not get a PHP2Shell fix through yum update. The upstream mitigations are only partial. With these builds, administrators can:

• close both CVEs on any branch from 5.6 to 8.4 with an in-place yum upgrade and a service restart;
• keep their existing PECL extensions, ionCube Loader and configuration;
• downgrade back to Remi if needed, with the exceptions noted above.

Related Note

The article also mentions GetPageSpeed Amplify, the existing NGINX monitoring service. It runs scheduled gixy scans across hosts and ties findings to live NGINX runtime metrics. It is drop-in compatible with the deprecated nginx-amplify-agent (EOL January 2026).

Read the full article: PHP2Shell on CentOS 7: Patched PHP 5.6 to 8.4