PHP 5.6.40 PHP2Shell Mitigation RPM

Overview

This repository contains RPM packages rebuilt from Remi Collet's PHP 5.6.40 security backports for EL6, with additional security patches to address the PHP2Shell vulnerabilities.

Target vulnerabilities:

• CVE-2026-109618
• CVE-2026-109619

Changes

• Based on Remi Collet's PHP-5.6-security-backports source code.
• Added Anton Barinov's php-5.6-enhanced-remicollet.patch as Patch1 in the SPEC file, applied automatically during the %prep stage.
• Modified the SPEC file for EL6 compatibility.
• Preserved the original RPM Release number: 23.el6.remi.

The original Release number was retained to maintain version dependencies with related packages such as php-common.

RPM Information

Item	Value
PHP Version	5.6.40
Target Environment	EL6 x86_64
RPM Release	23.el6.remi
Architecture	x86_64

Installation

If PHP 5.6.40-23.el6.remi is already installed, use either of the following commands to reinstall the package using the RPM provided in this repository.

Using yum:

yum reinstall --disablerepo='*' php-5.6.40-23.el6.remi.x86_64.rpm

Or using rpm:

rpm -Uvh --replacepkgs php-5.6.40-23.el6.remi.x86_64.rpm

The yum command displays a transaction summary and prompts for confirmation before proceeding. Enter y to continue or N to cancel.

The rpm command performs the reinstall without an interactive confirmation prompt. To test the transaction without installing the package, run:

rpm -Uvh --replacepkgs --test php-5.6.40-23.el6.remi.x86_64.rpm

Run the installation command from the directory containing the RPM file.

Repository Structure

• RPMS/x86_64/ - Built binary RPM packages
• SOURCES/ - PHP source code, patches, and configuration files
• SPECS/ - RPM SPEC file
• SRPMS/ - Source RPM package
• BUILD.md - Build instructions
• SHA256SUMS - SHA-256 checksums of the included files

References

• Remi Collet's PHP 5.6 Security Backports
  https://github.com/remicollet/php-src-security/tree/PHP-5.6-security-backports

• Anton Barinov's PHP2Shell Patches
  https://github.com/Anton-Barinov/php2shell-patches

• Remi RPM Archive (EL6 PHP 5.6)
  https://rpms.remirepo.net/archives/enterprise/6/php56/x86_64/

Disclaimer

This repository is intended for maintaining existing environments running PHP 5.6.40.

PHP 5.6 and RHEL/CentOS 6 are legacy versions. Additional security measures are required for the entire operating environment, including the operating system and PHP runtime.

The patches included in this repository do not guarantee protection against vulnerabilities other than those explicitly listed above.