x86_64 GetPageSpeed extras (php54) repository for CentOS/RHEL 7

Update: php-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php
Summary: PHP scripting language for creating dynamic web sites

Description:
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Changes:

php-5.4.45-26.el7.x86_64 [2.8 MiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-5.4.45-25.el7.x86_64 [2.8 MiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-5.4.45-24.el7.x86_64 [2.8 MiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-5.4.45-23.el7.x86_64 [2.8 MiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-5.4.45-22.el7.x86_64 [2.8 MiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-5.4.45-21.el7.x86_64 [2.8 MiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-5.4.45-20.el7.x86_64 [2.8 MiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-bcmath-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-bcmath
Summary: A module for PHP applications for using the bcmath library

Description:
The php-bcmath package contains a dynamic shared object that will add support for using the bcmath library to PHP.

Changes:

php-bcmath-5.4.45-26.el7.x86_64 [77 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-bcmath-5.4.45-25.el7.x86_64 [77 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-bcmath-5.4.45-24.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-bcmath-5.4.45-23.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-bcmath-5.4.45-22.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-bcmath-5.4.45-21.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-bcmath-5.4.45-20.el7.x86_64 [75 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-cli-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-cli
Summary: Command-line interface for PHP

Description:
The php-cli package contains the command-line interface executing PHP scripts, /usr/bin/php, and the CGI interface.

Changes:

php-cli-5.4.45-26.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-cli-5.4.45-25.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-cli-5.4.45-24.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-cli-5.4.45-23.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-cli-5.4.45-22.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-cli-5.4.45-21.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-cli-5.4.45-20.el7.x86_64 [4.0 MiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-common-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-common
Summary: Common files for PHP

Description:
The php-common package contains files used by both the php package and the php-cli package.

Changes:

php-common-5.4.45-26.el7.x86_64 [926 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-common-5.4.45-25.el7.x86_64 [926 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-common-5.4.45-24.el7.x86_64 [924 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-common-5.4.45-23.el7.x86_64 [924 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-common-5.4.45-22.el7.x86_64 [924 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-common-5.4.45-21.el7.x86_64 [924 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-common-5.4.45-20.el7.x86_64 [922 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-dba-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-dba
Summary: A database abstraction layer module for PHP applications

Description:
The php-dba package contains a dynamic shared object that will add support for using the DBA database abstraction layer to PHP.

Changes:

php-dba-5.4.45-26.el7.x86_64 [82 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-dba-5.4.45-25.el7.x86_64 [82 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-dba-5.4.45-24.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-dba-5.4.45-23.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-dba-5.4.45-22.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-dba-5.4.45-21.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-dba-5.4.45-20.el7.x86_64 [80 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-devel-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-devel
Summary: Files needed for building PHP extensions

Description:
The php-devel package contains the files needed for building PHP extensions. If you need to compile your own PHP extensions, you will need to install this package.

Changes:

php-devel-5.4.45-26.el7.x86_64 [984 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-devel-5.4.45-25.el7.x86_64 [984 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-devel-5.4.45-24.el7.x86_64 [982 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-devel-5.4.45-23.el7.x86_64 [982 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-devel-5.4.45-22.el7.x86_64 [982 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-devel-5.4.45-21.el7.x86_64 [982 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-devel-5.4.45-20.el7.x86_64 [981 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-embedded-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-embedded
Summary: PHP library for embedding in applications

Description:
The php-embedded package contains a library which can be embedded into applications to provide PHP scripting language support.

Changes:

php-embedded-5.4.45-26.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-embedded-5.4.45-25.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-embedded-5.4.45-24.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-embedded-5.4.45-23.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-embedded-5.4.45-22.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-embedded-5.4.45-21.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-embedded-5.4.45-20.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-enchant-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-enchant
Summary: Enchant spelling extension for PHP applications

Description:
The php-enchant package contains a dynamic shared object that will add support for using the enchant library to PHP.

Changes:

php-enchant-5.4.45-26.el7.x86_64 [58 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-enchant-5.4.45-25.el7.x86_64 [58 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-enchant-5.4.45-24.el7.x86_64 [57 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-enchant-5.4.45-23.el7.x86_64 [57 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-enchant-5.4.45-22.el7.x86_64 [57 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-enchant-5.4.45-21.el7.x86_64 [57 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-enchant-5.4.45-20.el7.x86_64 [56 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-fpm-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-fpm
Summary: PHP FastCGI Process Manager

Description:
PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites.

Changes:

php-fpm-5.4.45-26.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-fpm-5.4.45-25.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-fpm-5.4.45-24.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-fpm-5.4.45-23.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-fpm-5.4.45-22.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-fpm-5.4.45-21.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-fpm-5.4.45-20.el7.x86_64 [1.4 MiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-gd-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-gd
Summary: A module for PHP applications for using the gd graphics library

Description:
The php-gd package contains a dynamic shared object that will add support for using the gd graphics library to PHP.

Changes:

php-gd-5.4.45-26.el7.x86_64 [168 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-gd-5.4.45-25.el7.x86_64 [168 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-gd-5.4.45-24.el7.x86_64 [167 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-gd-5.4.45-23.el7.x86_64 [167 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-gd-5.4.45-22.el7.x86_64 [167 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-gd-5.4.45-21.el7.x86_64 [167 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-gd-5.4.45-20.el7.x86_64 [166 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-imap-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-imap
Summary: A module for PHP applications that use IMAP

Description:
The php-imap package contains a dynamic shared object (DSO) for the Apache Web server. When compiled into Apache, the php-imap module will add IMAP (Internet Message Access Protocol) support to PHP. IMAP is a protocol for retrieving and uploading e-mail messages on mail servers. PHP is an HTML-embedded scripting language. If you need IMAP support for PHP applications, you will need to install this package and the php package.

Changes:

php-imap-5.4.45-26.el7.x86_64 [99 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-imap-5.4.45-25.el7.x86_64 [99 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-imap-5.4.45-24.el7.x86_64 [98 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-imap-5.4.45-23.el7.x86_64 [98 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-imap-5.4.45-22.el7.x86_64 [98 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-imap-5.4.45-21.el7.x86_64 [97 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-imap-5.4.45-20.el7.x86_64 [95 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-interbase-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-interbase
Summary: A module for PHP applications that use Interbase/Firebird databases

Description:
The php-interbase package contains a dynamic shared object that will add database support through Interbase/Firebird to PHP. InterBase is the name of the closed-source variant of this RDBMS that was developed by Borland/Inprise. Firebird is a commercially independent project of C and C++ programmers, technical advisors and supporters developing and enhancing a multi-platform relational database management system based on the source code released by Inprise Corp (now known as Borland Software Corp) under the InterBase Public License.

Changes:

php-interbase-5.4.45-26.el7.x86_64 [115 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-interbase-5.4.45-25.el7.x86_64 [115 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-interbase-5.4.45-24.el7.x86_64 [115 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-interbase-5.4.45-23.el7.x86_64 [114 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-interbase-5.4.45-22.el7.x86_64 [114 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-interbase-5.4.45-21.el7.x86_64 [114 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-interbase-5.4.45-20.el7.x86_64 [113 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-intl-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-intl
Summary: Internationalization extension for PHP applications

Description:
The php-intl package contains a dynamic shared object that will add support for using the ICU library to PHP.

Changes:

php-intl-5.4.45-26.el7.x86_64 [149 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-intl-5.4.45-25.el7.x86_64 [149 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-intl-5.4.45-24.el7.x86_64 [148 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-intl-5.4.45-23.el7.x86_64 [147 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-intl-5.4.45-22.el7.x86_64 [147 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-intl-5.4.45-21.el7.x86_64 [147 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-intl-5.4.45-20.el7.x86_64 [147 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-ldap-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-ldap
Summary: A module for PHP applications that use LDAP

Description:
The php-ldap package is a dynamic shared object (DSO) for the Apache Web server that adds Lightweight Directory Access Protocol (LDAP) support to PHP. LDAP is a set of protocols for accessing directory services over the Internet. PHP is an HTML-embedded scripting language. If you need LDAP support for PHP applications, you will need to install this package in addition to the php package.

Changes:

php-ldap-5.4.45-26.el7.x86_64 [78 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-ldap-5.4.45-25.el7.x86_64 [78 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-ldap-5.4.45-24.el7.x86_64 [77 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-ldap-5.4.45-23.el7.x86_64 [77 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-ldap-5.4.45-22.el7.x86_64 [77 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-ldap-5.4.45-21.el7.x86_64 [77 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-ldap-5.4.45-20.el7.x86_64 [76 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-litespeed-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-litespeed
Summary: LiteSpeed Web Server PHP support

Description:
The php-litespeed package provides the /usr/bin/lsphp command used by the LiteSpeed Web Server (LSAPI enabled PHP).

Changes:

php-litespeed-5.4.45-26.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-litespeed-5.4.45-25.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-litespeed-5.4.45-24.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-litespeed-5.4.45-23.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-litespeed-5.4.45-22.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-litespeed-5.4.45-21.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-litespeed-5.4.45-20.el7.x86_64 [1.3 MiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-mbstring-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-mbstring
Summary: A module for PHP applications which need multi-byte string handling

Description:
The php-mbstring package contains a dynamic shared object that will add support for multi-byte string handling to PHP.

Changes:

php-mbstring-5.4.45-26.el7.x86_64 [567 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-mbstring-5.4.45-25.el7.x86_64 [566 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-mbstring-5.4.45-24.el7.x86_64 [565 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-mbstring-5.4.45-23.el7.x86_64 [565 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-mbstring-5.4.45-22.el7.x86_64 [565 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-mbstring-5.4.45-21.el7.x86_64 [564 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-mbstring-5.4.45-20.el7.x86_64 [565 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-mcrypt-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-mcrypt
Summary: Standard PHP module provides mcrypt library support

Description:
The php-mcrypt package contains a dynamic shared object that will add support for using the mcrypt library to PHP.

Changes:

php-mcrypt-5.4.45-26.el7.x86_64 [67 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-mcrypt-5.4.45-25.el7.x86_64 [67 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-mcrypt-5.4.45-24.el7.x86_64 [66 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-mcrypt-5.4.45-23.el7.x86_64 [66 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-mcrypt-5.4.45-22.el7.x86_64 [66 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-mcrypt-5.4.45-21.el7.x86_64 [66 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-mcrypt-5.4.45-20.el7.x86_64 [65 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-mssql-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-mssql
Summary: MSSQL database module for PHP

Description:
The php-mssql package contains a dynamic shared object that will add MSSQL and Sybase database support to PHP. It uses the TDS (Tabular DataStream) protocol through the freetds library, hence any database server which supports TDS can be accessed.

Changes:

php-mssql-5.4.45-26.el7.x86_64 [107 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-mssql-5.4.45-25.el7.x86_64 [107 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-mssql-5.4.45-24.el7.x86_64 [106 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-mssql-5.4.45-23.el7.x86_64 [105 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-mssql-5.4.45-22.el7.x86_64 [105 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-mssql-5.4.45-21.el7.x86_64 [105 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-mssql-5.4.45-20.el7.x86_64 [105 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-mysql-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-mysql
Summary: A module for PHP applications that use MySQL databases

Description:
The php-mysql package contains a dynamic shared object that will add MySQL database support to PHP. MySQL is an object-relational database management system. PHP is an HTML-embeddable scripting language. If you need MySQL support for PHP applications, you will need to install this package and the php package.

Changes:

php-mysql-5.4.45-26.el7.x86_64 [161 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-mysql-5.4.45-25.el7.x86_64 [161 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-mysql-5.4.45-24.el7.x86_64 [160 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-mysql-5.4.45-23.el7.x86_64 [159 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-mysql-5.4.45-22.el7.x86_64 [159 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-mysql-5.4.45-21.el7.x86_64 [159 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-mysql-5.4.45-20.el7.x86_64 [158 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-mysqlnd-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-mysqlnd
Summary: A module for PHP applications that use MySQL databases

Description:
The php-mysqlnd package contains a dynamic shared object that will add MySQL database support to PHP. MySQL is an object-relational database management system. PHP is an HTML-embeddable scripting language. If you need MySQL support for PHP applications, you will need to install this package and the php package. This package use the MySQL Native Driver

Changes:

php-mysqlnd-5.4.45-26.el7.x86_64 [296 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-mysqlnd-5.4.45-25.el7.x86_64 [296 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-mysqlnd-5.4.45-24.el7.x86_64 [294 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-mysqlnd-5.4.45-23.el7.x86_64 [294 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-mysqlnd-5.4.45-22.el7.x86_64 [294 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-mysqlnd-5.4.45-21.el7.x86_64 [294 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-mysqlnd-5.4.45-20.el7.x86_64 [293 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-odbc-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-odbc
Summary: A module for PHP applications that use ODBC databases

Description:
The php-odbc package contains a dynamic shared object that will add database support through ODBC to PHP. ODBC is an open specification which provides a consistent API for developers to use for accessing data sources (which are often, but not always, databases). PHP is an HTML-embeddable scripting language. If you need ODBC support for PHP applications, you will need to install this package and the php package.

Changes:

php-odbc-5.4.45-26.el7.x86_64 [97 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-odbc-5.4.45-25.el7.x86_64 [97 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-odbc-5.4.45-24.el7.x86_64 [96 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-odbc-5.4.45-23.el7.x86_64 [96 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-odbc-5.4.45-22.el7.x86_64 [96 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-odbc-5.4.45-21.el7.x86_64 [95 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-odbc-5.4.45-20.el7.x86_64 [95 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-pdo-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-pdo
Summary: A database access abstraction module for PHP applications

Description:
The php-pdo package contains a dynamic shared object that will add a database access abstraction layer to PHP. This module provides a common interface for accessing MySQL, PostgreSQL or other databases.

Changes:

php-pdo-5.4.45-26.el7.x86_64 [152 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-pdo-5.4.45-25.el7.x86_64 [152 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-pdo-5.4.45-24.el7.x86_64 [151 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-pdo-5.4.45-23.el7.x86_64 [150 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-pdo-5.4.45-22.el7.x86_64 [150 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-pdo-5.4.45-21.el7.x86_64 [150 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-pdo-5.4.45-20.el7.x86_64 [149 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-pgsql-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-pgsql
Summary: A PostgreSQL database module for PHP

Description:
The php-pgsql package includes a dynamic shared object (DSO) that can be compiled in to the Apache Web server to add PostgreSQL database support to PHP. PostgreSQL is an object-relational database management system that supports almost all SQL constructs. PHP is an HTML-embedded scripting language. If you need back-end support for PostgreSQL, you should install this package in addition to the main php package.

Changes:

php-pgsql-5.4.45-26.el7.x86_64 [138 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-pgsql-5.4.45-25.el7.x86_64 [138 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-pgsql-5.4.45-24.el7.x86_64 [137 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-pgsql-5.4.45-23.el7.x86_64 [137 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-pgsql-5.4.45-22.el7.x86_64 [137 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-pgsql-5.4.45-21.el7.x86_64 [137 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-pgsql-5.4.45-20.el7.x86_64 [136 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-process-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-process
Summary: Modules for PHP script using system process interfaces

Description:
The php-process package contains dynamic shared objects which add support to PHP using system interfaces for inter-process communication.

Changes:

php-process-5.4.45-26.el7.x86_64 [82 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-process-5.4.45-25.el7.x86_64 [82 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-process-5.4.45-24.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-process-5.4.45-23.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-process-5.4.45-22.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-process-5.4.45-21.el7.x86_64 [81 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-process-5.4.45-20.el7.x86_64 [80 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-pspell-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-pspell
Summary: A module for PHP applications for using pspell interfaces

Description:
The php-pspell package contains a dynamic shared object that will add support for using the pspell library to PHP.

Changes:

php-pspell-5.4.45-26.el7.x86_64 [57 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-pspell-5.4.45-25.el7.x86_64 [57 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-pspell-5.4.45-24.el7.x86_64 [56 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-pspell-5.4.45-23.el7.x86_64 [56 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-pspell-5.4.45-22.el7.x86_64 [56 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-pspell-5.4.45-21.el7.x86_64 [56 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-pspell-5.4.45-20.el7.x86_64 [55 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-recode-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-recode
Summary: A module for PHP applications for using the recode library

Description:
The php-recode package contains a dynamic shared object that will add support for using the recode library to PHP.

Changes:

php-recode-5.4.45-26.el7.x86_64 [52 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-recode-5.4.45-25.el7.x86_64 [52 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-recode-5.4.45-24.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-recode-5.4.45-23.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-recode-5.4.45-22.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-recode-5.4.45-21.el7.x86_64 [51 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-recode-5.4.45-20.el7.x86_64 [50 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-snmp-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-snmp
Summary: A module for PHP applications that query SNMP-managed devices

Description:
The php-snmp package contains a dynamic shared object that will add support for querying SNMP devices to PHP. PHP is an HTML-embeddable scripting language. If you need SNMP support for PHP applications, you will need to install this package and the php package.

Changes:

php-snmp-5.4.45-26.el7.x86_64 [75 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-snmp-5.4.45-25.el7.x86_64 [75 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-snmp-5.4.45-24.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-snmp-5.4.45-23.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-snmp-5.4.45-22.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-snmp-5.4.45-21.el7.x86_64 [74 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-snmp-5.4.45-20.el7.x86_64 [73 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-soap-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-soap
Summary: A module for PHP applications that use the SOAP protocol

Description:
The php-soap package contains a dynamic shared object that will add support to PHP for using the SOAP web services protocol.

Changes:

php-soap-5.4.45-26.el7.x86_64 [252 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-soap-5.4.45-25.el7.x86_64 [252 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-soap-5.4.45-24.el7.x86_64 [250 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-soap-5.4.45-23.el7.x86_64 [250 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-soap-5.4.45-22.el7.x86_64 [250 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-soap-5.4.45-21.el7.x86_64 [250 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-soap-5.4.45-20.el7.x86_64 [249 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-tidy-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-tidy
Summary: Standard PHP module provides tidy library support

Description:
The php-tidy package contains a dynamic shared object that will add support for using the tidy library to PHP.

Changes:

php-tidy-5.4.45-26.el7.x86_64 [72 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-tidy-5.4.45-25.el7.x86_64 [72 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-tidy-5.4.45-24.el7.x86_64 [71 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-tidy-5.4.45-23.el7.x86_64 [71 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-tidy-5.4.45-22.el7.x86_64 [71 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-tidy-5.4.45-21.el7.x86_64 [71 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-tidy-5.4.45-20.el7.x86_64 [70 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable

Update: php-xml-5.4.45-26.el7

Fri, 30 Oct 2026 08:49:14 +0000

Package: php-xml
Summary: A module for PHP applications which use XML

Description:
The php-xml package contains dynamic shared objects which add support to PHP for manipulating XML documents using the DOM tree, and performing XSL transformations on XML documents.

Changes:

php-xml-5.4.45-26.el7.x86_64 [208 KiB]	Changelog by Danila Vershinin (2026-10-30): - php -v and phpinfo Build Provider show the package release
php-xml-5.4.45-25.el7.x86_64 [208 KiB]	Changelog by Danila Vershinin (2026-10-30): - port the 2015-2019 upstream 5.6 security fixes (5.6.14 to 5.6.40) that Remi's 5.4 backports never carried (Patch700-797), among them CVE-2016-7124 CVE-2016-7125 CVE-2016-7411 CVE-2016-7413 CVE-2016-7417 CVE-2016-7418 CVE-2016-7129 CVE-2016-7130 CVE-2016-7131 CVE-2016-7132 CVE-2016-9934 CVE-2016-9935 CVE-2016-10161 CVE-2017-12933 CVE-2017-11143 CVE-2017-11145 CVE-2017-16642 CVE-2018-10546 CVE-2018-10547 CVE-2018-10548 CVE-2018-10549 CVE-2018-14883 CVE-2018-20783 CVE-2019-9021 CVE-2019-9023 and the bundled Oniguruma CVE-2017-9224/9226/9227/9228/9229; full list in SECURITY.md
php-xml-5.4.45-24.el7.x86_64 [205 KiB]	Changelog by Danila Vershinin (2026-10-29): - complete the #81720 fix (CVE-2022-31625): pg_* parameter conversion failure no longer frees uninitialized entries in the two remaining functions
php-xml-5.4.45-23.el7.x86_64 [205 KiB]	Changelog by Danila Vershinin (2026-10-27): - support a license file at /etc/getpagespeed/license.jwt
php-xml-5.4.45-22.el7.x86_64 [205 KiB]	Changelog by Danila Vershinin (2026-10-27): - license heartbeat sends /etc/getpagespeed/license.jwt as "token" when present, licensing by token instead of source IP; own /etc/getpagespeed
php-xml-5.4.45-21.el7.x86_64 [205 KiB]	Changelog by Danila Vershinin (2026-10-27): - Port the 2019-2021 part of the php-rpm 5.6 security stack (Patch600+): CVE-2019-13224 CVE-2019-9640 CVE-2019-9638 CVE-2019-9637 CVE-2019-11034 CVE-2019-11035 CVE-2019-11036 CVE-2019-11040 CVE-2019-11039 CVE-2019-11041 CVE-2019-11042 CVE-2019-11050 CVE-2019-11044 CVE-2019-11045 CVE-2019-11048 CVE-2019-11046 CVE-2019-11047 CVE-2020-7060 CVE-2020-7063 CVE-2020-7059 CVE-2020-7062 CVE-2020-7064 CVE-2020-7066 CVE-2020-7067 CVE-2020-7070 CVE-2020-7068 CVE-2021-21707 CVE-2021-21702 CVE-2021-21703 CVE-2021-21704, plus #76846 #77396 #77431 #77586 - Port the upstream 5.6.37 exif fix #76557 (CVE-2018-14851) these build on - FPM scoreboard procs now live inline in shared memory (CVE-2021-21703)
php-xml-5.4.45-20.el7.x86_64 [204 KiB]	Changelog by Danila Vershinin (2026-10-27): - GetPageSpeed Everpatch rebuild of Remi's final 5.4.45-19 for EL7; drop-in upgrade from stock CentOS 7 php-5.4.16 (same php-api/zend-abi, package names and /etc/php.d layout); provenance in SECURITY.md - Fix RCE via OOM corruption GHSA-w8hw-w9fx-j79w CVE-2026-109618 - Fix RCE via stale global state GHSA-6wmf-4rv5-p3rp CVE-2026-109619 - Port the 2022-2026 security fixes of the php-rpm 5.6 stack: CVE-2023-0662 CVE-2023-3247 CVE-2023-3823 CVE-2023-3824 CVE-2024-2756 CVE-2024-5458 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927 CVE-2024-11234 CVE-2024-11233 GHSA-4w77-75f9-2c8w CVE-2026-7261 CVE-2026-7262 CVE-2026-6735 GH-22187 - Port the October 2026 security batch: CVE-2026-92842 CVE-2025-1218 CVE-2026-91766 CVE-2026-91765 CVE-2025-14181 CVE-2026-6103 GHSA-ch8v-r6jh-4vvr - Not applicable to 5.4 (code absent): CVE-2024-3096, CVE-2024-8932, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-93682 - GetPageSpeed branding: Vendor and Packager tags, phpinfo Build Provider, php -v prints "Built by GetPageSpeed LLC" - add gps_license license-presence extension, statically compiled into every SAPI, with its cron.daily heartbeat (ADR-002) - php-common requires getpagespeed-extras-release - fail the build on any packaged /etc file that is not world-readable