php56w for CentOS 6 with the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619)

Community rebuild of Webtatic's php56w 5.6.40 packages for CentOS 6 / RHEL 6 (x86_64), with a backport of the upstream fix for CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), "Avoid state corruption via bailout", also known as PHP2Shell.

The packages are a drop-in upgrade for php56w-*-5.6.40-1.w6, which Webtatic stopped maintaining in 2019.

Warning

• Not an official PHP release. The patch is a community backport and has not been reviewed by the PHP Group.
• PHP 5.6 has been end-of-life since 31 December 2018. This build is 5.6.40 plus this single fix. It does not include any other security fix released since 2019. Treat it as a stopgap while you migrate, not as a supported PHP.
• Validation is still in progress. See docs/TESTING.md before deploying to production.

Status

Package	php56w-5.6.40-2.el6 (x86_64)
Target	CentOS 6 / RHEL 6 (EL6), Apache httpd 2.2 (httpd-mmn 20051115)
Built on	Clean CentOS 6.10 VM (kernel 2.6.32-754.35.1.el6)
Toolchain	GCC 4.4.7 20120313 (Red Hat 4.4.7-23), binutils 2.20.51.0.2-5.48.el6_10.1, glibc 2.12-1.212.el6_10.3, rpm-build 4.8.0-59.el6
Built against	httpd-devel 2.2.15-69.el6.centos, openssl-devel 1.0.1e-58.el6_10, libxml2-devel 2.7.6-21.el6_8.1. Full manifest in docs/build-env/
PHP ABI	Unchanged from stock 5.6.40 (PHP API 20131106, Zend Module API 20131226, Zend Extension API 220131226). ionCube Loader 5.6 and PECL extensions keep working without a rebuild
Patch applies	Cleanly, with --fuzz=0, on top of Webtatic's 12 patches
Build	Full rpmbuild -ba, 33 binary RPMs + SRPM, exit 0
PHP test suite	Not run yet
Behavior tests	In progress

Download

Binary RPMs, the SRPM and SHA256SUMS are attached to each GitHub Release. They are not stored in git.

sha256sum -c SHA256SUMS

The packages are not GPG-signed. Verify them with SHA256SUMS.

Behavior changes

These come from the upstream fix and are intentional.

1. Memory exhaustion (memory_limit) and internal allocation errors (size overflows) now terminate the process immediately with _exit(1).

   • The Fatal error: ... message goes to stderr (with mod_php, to /var/log/httpd/error_log), not to PHP's error_log.
   • Shutdown functions, destructors, session write and output buffer flushing do not run.
   • The client gets a closed connection with no response instead of an HTTP 500. Apache starts a new child process.
   • The CLI exit code changes from 255 to 1.

2. Session upload progress is disabled. session.upload_progress.enabled has no effect, and $_SESSION no longer receives the progress keys. Check whether your applications use it:

   grep -rn 'upload_progress\|PHP_SESSION_UPLOAD_PROGRESS' /var/www /etc/php.ini /etc/php.d

3. New INI directive max_multipart_body_parts (PHP_INI_SYSTEM|PHP_INI_PERDIR). The default -1 means max_input_vars + max_file_uploads. When a multipart request exceeds it, PHP emits a warning and ignores the rest of the body. This is the fix for CVE-2023-0662, which PHP 5.6 never received.

4. Multipart parsing keeps only the Content-Disposition and Content-Type headers of each part and ignores duplicates. The max_file_uploads warning is emitted once.

Install

Requirements: CentOS 6 x86_64 with base and updates (from vault.centos.org) and EPEL 6 (from the Fedora archive). Some extensions need EPEL: t1lib for gd, libmcrypt for mcrypt, and so on.

# 1. Back up the installed packages; the Webtatic repository may no longer be available
yum -y install rpmrebuild
mkdir -p ~/php56w-backup
for p in $(rpm -qa --qf '%{NAME}\n' 'php56w*'); do rpmrebuild --batch --directory ~/php56w-backup "$p"; done

# 2. Upgrade every installed php56w package in one transaction
#    (example with a typical set; match it to the output of rpm -qa 'php56w*')
yum localinstall php56w-5.6.40-2.el6.x86_64.rpm \
    php56w-{cli,common,opcache,pdo,mysqlnd,gd,xml}-5.6.40-2.el6.x86_64.rpm

# 3. Restart Apache
service httpd restart

• Every subpackage requires php56w-common with the exact same version and release, so they must be upgraded together.
• Configuration is preserved (%config(noreplace)): /etc/php.ini and /etc/php.d/ are not overwritten.

Check the installed build:

rpm -q --changelog php56w-common | head -5
php -i | grep max_multipart_body_parts
nm -D /usr/lib64/httpd/modules/libphp5.so | grep zend_mm_safe_error_ex

Roll back:

rpm -Uvh --oldpackage $(find ~/php56w-backup -name '*.rpm') && service httpd restart

Repository layout

.
├── README.md
├── docs/
│   ├── BUILD-CENTOS6.md        Step-by-step build in a CentOS 6.10 VM
│   ├── TESTING.md              Validation plan and results
│   └── build-env/              Package manifest of the build VM
├── patches/
│   ├── README.md               Provenance of every patch
│   ├── php-5.6.40-CVE-2026-109618-109619.patch    The patch used in this build
│   └── upstream/               Reference copies of the source patches
└── rpm/
    ├── SPECS/php56.spec        Webtatic spec with the patch added
    ├── SPECS/php56.spec.webtatic-d9df9fba.diff     All changes to Webtatic's spec
    └── SOURCES/                Webtatic's patches and config files, unchanged

Sources

• PHP: php-5.6.40.tar.bz2 from php.net, SHA-256 ffd025d34623553ab2f7fd8fb21d0c9e6f9fa30dc565ca03a1d7b763023fba00. Use the release tarball, not a git snapshot: the spec relies on files that only the tarball contains (see docs/BUILD-CENTOS6.md).
• Spec and SOURCES: webtatic-rpms/php56w at commit d9df9fba (2019-01-12). The spec has four changes; see the .diff file.
• Patch: see patches/README.md.

Related work

• Upstream fix: php/php-src@712e60f9 (PHP-7.4 branch)
• Debian/Ubuntu packages: Ondřej Surý's PPA, php5.6 5.6.40-105
• vperetti/php-cve-2026-109618-109619-backports
• hirokidaichi/php56-cve-2026-backport-experiment
• Anton-Barinov/php2shell-patches

License

PHP and the patches derived from it are under the PHP License 3.01 and the Zend Engine License 2.00. The spec file derives from Webtatic's. Everything is provided as is, without warranty of any kind.