StackX PHP: maintenance and fixes for Debian 9, 10 and 11

StackX PHP

It all started with PHP2Shell.

There is a fictional world where every application keeps up with every system and service update… and then there is the real world.

That world is the one some of our clients at ScalarX live in: a world where a migration does not necessarily start or finish within the deadline imposed by the disclosure of a vulnerability, however critical it may be.

I have never judged a client because they have not yet migrated or updated their application. I know the operational reality: we explain the risks, encourage them to move to supported versions and help them through it. And in the meantime, we keep looking for ways to protect their services.

An old line-of-business application, a blocking dependency, an integrated industrial system, a medical system that is essential to thousands of patients and still depends on obsolete protocols hard-coded into the equipment, or simply a migration project that is running late… the constraints exist, and they are real. And our job is also to deal with them.

With PHP2Shell, we therefore had to find solutions quickly, especially for Debian 9 Stretch and Debian 10 Buster.

So, with the support of my agentic systems (elora.systems), I carried out backporting work for these older Debian releases, initially using the PHP fixes already produced by Sury for Debian 11, 12 and 13: adapting the fixes, rebuilding the packages and extensions, and testing updates and the coexistence of every PHP version supported on those distributions.

Originally, this work was intended solely for our StackX clients. But as with other tools and patches long before it, including Shellshock and GHOST, I know this work can help others. And even if it only helps one other person, then it is worth sharing 🙂

Over the following days, the project grew: first, to integrate all the important fixes released since 2023 that had never been integrated into these versions, and now to integrate the latest fixes as they are released on php.net.

StackX PHP now provides maintained PHP packages for Debian 9 Stretch, Debian 10 Buster and Debian 11 Bullseye, on amd64. Fixes are adapted to the branches that are actually in use: packages are rebuilt and tested on local virtual machines, their dependencies are checked, and they are then distributed through signed APT repositories.

This contribution is first and foremost for us: it primarily addresses the needs of legacy StackX by ScalarX versions, for clients who cannot migrate in time because of a wide range of financial or operational constraints.

The packages, their sources, full versions and checksums are also available to the community.

30 published PHP and Debian combinations

The upstream number does not tell the whole story. PHP 8.1, for example, is based on 8.1.7 for Stretch, 8.1.29 for Buster and 8.1.34 for Bullseye. An older upstream number may still identify a package that received later fixes. The useful identity is therefore the combination of distribution, upstream version and full Debian revision. The published versions table is the reference.

What was actually done

The original sources and packaging remain credited to PHP, Debian, Sury and their authors. StackX contributes applicability analysis, backports or adaptations, additional fixes, testing, packaging, dependency integration and signed distribution.

For Stretch and Buster, the work includes, among other changes:

• the PHP2Shell, CVE-2026-109618 and CVE-2026-109619 fixes;
• additional multipart processing, multibyte field-name and processing-limit fixes, including CVE-2023-0662 on the affected branches;
• the metaphone fix associated with CVE-2026-7568 on the affected branches;
• backports of fixes published since 2023 in Phar, libxml, cookies, CGI redirect checks and database drivers;
• branch-specific changes in PDO/MySQL, mysqlnd, PostgreSQL, cURL, OpenSSL, mbstring, Zend, OPcache and PHP-FPM.

The scope is determined branch by branch. Between PHP 5.6 and PHP 8.5, internal APIs, strings, resources, extension interfaces and tests changed. Blindly applying the same patch everywhere would have been easier. It would not have been serious.

On Bullseye, the current delivery starts from recent Sury sources and adds the Phar change described below to all twelve branches. Fixes inherited from those sources obviously do not magically become StackX fixes.

A concrete Phar example

GH-25093 affects Phar::webPhar(). In a redirect path used by non-CGI interfaces, the code used the full archive path length when advancing through the request URI. The fix uses the archive base-name length instead, preventing a read beyond the URI.

It comes from PHP commit 2ff2085, associated with pull request #25102. This change is included in all 30 published combinations. The PHP 5.6 port also contains the adjustment required for the lifetime of the string returned by the rewrite callback.

Packages and dependencies

The 6 November delivery, checked online on 7 November 2026, contains 2,888 DEB files: 920 for Stretch, 1,109 for Buster and 859 for Bullseye. This includes PHP packages, extensions, support packages, dependencies and debug symbols. The meaningful number remains the 30 PHP/distribution combinations, not a contest over file counts.

Depending on the branch, the repositories include the command-line interface, PHP-FPM, CGI, the Apache module, extensions and development files. The exact inventory is published in PAQUETS.tsv.

The specific dependencies required by all 30 families, including development packages, are included so that they can be resolved without an external Sury repository. The Debian system repositories for the corresponding release are still required. StackX PHP is self-contained from Sury for this PHP scope, not a complete Debian mirror.

What was verified

Checks cover the actual sources, full versions, built packages and installed binaries. They include functional tests in isolated environments, regression tests tailored to the changes and dependency verification.

• The 18 Stretch and Buster families were qualified across CLI, CGI and FPM, with the targeted tests and memory checks selected for the fixes.
• The Bullseye Phar addition was qualified separately across its twelve branches.
• Dependency resolution was checked for all 30 families, both for runtime and for the full set of published PHP packages.
• Sources and checksums connect the fixes to the distributed files.

Earlier PHP campaigns were deployed for our clients across hundreds of machines. I have also seen hundreds of machines on the Internet use these repositories. The only feedback I have received so far has been a handful of messages thanking us: no issue has yet been reported. That is operational experience, not a universal promise retroactively attached to every future revision.

Signed repositories and APT source setup

Each distribution has a repository signed with InRelease and Release.gpg. The key is restricted to this APT source through signed-by.

AF97 ED98 AACE 4CE1 29A0 3B6E 2C97 36B5 93BA BF7F

The public repository setup script can and should be reviewed before execution. It detects Debian 9, 10 or 11, verifies the key fingerprint and the corresponding repository signature, installs a source restricted through signed-by, and preserves any existing configuration it does not recognise. It installs no package, runs no upgrade and restarts no service.

Scope and limits

This maintenance does not turn an old Debian release into a fully maintained distribution. It covers the PHP components distributed here. It is neither exhaustive coverage of every PHP vulnerability nor security support for the entire operating system.

Memory observations performed for selected fixes are not a general certification that PHP has no memory leaks. Coverage varies by branch, and every listed fix does not automatically apply to all 30 combinations. Finally, these repositories address continuity for existing systems. They are not a recommendation to start a new project on an old platform today.

Resources

• StackX PHP mirror
• Debian 9 Stretch repository
• Debian 10 Buster repository
• Debian 11 Bullseye repository
• PHP versions and full Debian revisions
• Package inventory
• SHA256 checksums
• Repository public key
• StackX kernels for Debian 9, 10 and 11

Sources and components retain their original licences and attribution.

—
Christophe Casalegno (find all my social networks at: all.bo)