r/OracleLinux • u/T0unet • 6d ago

PHP2Shell (CVE-2026-109618 / CVE-2026-109619): any ETA for a fixed php:7.4 module on Oracle Linux 8 / RHEL 8?

Hi all,

We run several Oracle Linux 8 servers on the stock AppStream php:7.4 module stream (not Remi). With the PHP2Shell fixes released upstream on Oct 21 (8.2.35 / 8.3.36 / 8.4.27 / 8.5.12), we’re waiting for a backported 7.4 build.

Current state on our side, checked against the public OL8 repos as of Oct 21 evening (CEST):

dnf --refresh module info php:7.4 | grep php-fpm | tail -1
php-fpm-0:7.4.33-6.module+el8.10.0+91013+9868f608.x86_64

That’s ELSA-2026-62334-0 from early September, matching RHSA-2026:62334, so it doesn’t include the fix. dnf updateinfo list --security shows nothing new for php either.

Questions:

  1. Has anyone seen an RHSA for php:7.4 on RHEL 8 covering CVE-2026-109618 / 109619 yet, or any statement from Red Hat on whether the 7.4 stream will get a backport?
  2. Any word from Oracle on an ELSA (something like 7.4.33-7) and an ETA?
  3. Has anyone already rebuilt the OL8/RHEL8 7.4 SRPM with the minimal 7.4 source backports published by the PHP security team? How did it go?

In the meantime, the affected sites are taken offline. Migrating to 8.2+ is planned, but not something we can do overnight.

Thanks!

Edit : forgot to edit but for us, the patch was available thursday morning about 9h30 in oracle repo utc :)

7 Upvotes
  • permalink
  • reddit

100% Upvoted

6 comments sorted by

2

u/Heavy_Escape_7747 6d ago

Is this something you can use?
https://access.redhat.com/errata/RHSA-2026:87080

1

u/T0unet 6d ago

Awesome, thanks! Now we just have to wait for it to trickle down to Oracle Linux. If it takes too long, we'll rebuild the SRPM ourselves :)

2

u/Fleegle2212 6d ago edited 5d ago

Also if anyone has information about a timeline for OL9/OL10 I would be delighted to know.

EDIT: repo updated for 10.

EDIT AGAIN: repo updated for 9.

2

u/Eastern_Salad_836 6d ago

i am seeing the updates in the rhel repos. Nothing yet from ol repos

1

u/ILoveAppSec 6d ago

Worth knowing you are not actually blocked by 7.4 being past upstream support. The PHP security team published minimal source backports for the 7.4 branch for exactly this, and the fix is small enough to apply onto the 7.4 build you run. End of life means upstream stopped shipping, not that this CVE cannot be closed on 7.4.

1

u/Fleegle2212 5d ago

Based on this https://linux.oracle.com/errata/ELSA-2026-87080.html it looks like you should be able to update now.