https://seclists.org/oss-sec/2026/q4/315: Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux)
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
PHP PHP=7.3.33, =5.4.16, =5.3.29
Frequently Asked Questions
1
Which unsupported PHP deployments have source backports available?
Source backports are available for Remi php73 7.3.33-22 on CentOS/RHEL 7, PHP 5.4.16-46.amzn2.0.7 on Amazon Linux 2, and PHP 5.3.29-1.8.amzn1 on Amazon Linux 1. They are unofficial and have no support commitment.
2
Are Debian or Ubuntu systems using the Sury PPA already covered?
The fix is already present in Sury PPA packages php7.3 7.3.33-35, php7.4 7.4.33-31, php8.0 8.0.30-25, and php8.1 8.1.34-9. Their changelogs do not mention the CVEs.
3
What is required to use the provided backports?
They provide patches and Docker-based build scripts, not prebuilt binaries. The build scripts verify vendor SRPM signatures before applying the patches.
4
What is the recommended long-term remediation?
Upgrade to a supported PHP release. The available backports are described as a minimal mitigation for end-of-life platform packages, not a replacement for moving to a supported release.