What just happened with PHP2Shell is not new. There have been others before it that made a few sysadmins sweat; I am thinking in particular of Shellshock or GHOST (for which my old patches are still online).
There is a fictional world in which every application keeps pace with every system and service update… and then there is the real world. A world in which a server does not disappear on the day a distribution or service reaches end of life, any more than on the day a flaw is published.
That is the world some of our clients live in: a world in which a migration does not necessarily finish within the deadline imposed by the disclosure of a critical vulnerability, as in this case.
So what happens in real life? You shut down… you lose clients (who die…) or you find solutions! With PHP2Shell, we therefore had to find a solution, in our case, for machines that are still running Debian 9 (Stretch) and 10 (Buster).
At ScalarX, we do not judge clients because they have not migrated yet. We explain the risks to them, we encourage them to move to supported versions, we support them through it. And in the meantime, we keep looking for solutions to protect their services.
An old business application, a dependency that stands in the way, an integrated industrial system, a migration project that is running late… the constraints exist, and they are real. And our job is also to work with that.
So, with help from my agentic systems, I backported the fixes to these old Debian distributions, starting with the PHP fixes and the outstanding work Sury had already done for Debian 11, 12 and 13: adapting the fixes, rebuilding the packages and the extensions, testing updates and the coexistence of every PHP version that was supported on these distributions.
Originally, this work was meant for our StackX clients, but as with the rest of the tools I use, I think it can be useful to others, and even if that is only one other person: I might as well share it 🙂
The packages and their sources are therefore at your disposal, freely accessible:
ScalarX PHP repository for Debian 9 and 10
Available for amd64:
- Debian 9 Stretch: PHP 5.6, 7.0 to 7.4, 8.0 and 8.1.
- Debian 10 Buster: the same branches, plus PHP 8.2 and 8.3.
The packages include the PHP2Shell, CVE-2026-109618 and CVE-2026-109619 fixes, as well as the additional CVE-2023-0662 and CVE-2026-7568 fixes on the branches concerned.
The rebuilds and the targeted tests were done in isolated VMs, in particular to check the extensions, the uploads, the sessions and the multi-version coexistence used by StackX. Initial batches were also deployed on machines in our fleet, followed by deployment across the entire affected fleet, with no particular problems reported so far.
The sources and the packaging files containing the fixes are online. You can examine the changes, compare them and rebuild the packages yourself if you wish.
To make this easier to use, a Bash script detects Debian 9 or 10 and adds the matching repository. It installs nothing: you keep control of the updates with APT.
A few clarifications: this is provided as is, with no warranty, and it does not restore general support for these old versions. The repository is currently reachable over HTTPS, without APT signing. Test on a copy of your machine before you deploy: the checks that were carried out probably do not cover every application or every configuration; they are limited to ours.
Some behaviors change as well: native upload progress tracking is disabled on some branches, and the multipart fix adds a limit to the number of parts processed. Worth checking if your applications rely on these functions or use very large forms.
If it can get you out of a jam, save you time, or help you protect a machine that is waiting for its migration, help yourself. And detailed feedback is welcome.
Love <3
Leave a comment
Add a comment