Global – November 10, 2026 -- CIQ shipped fixed PHP 8.0 packages for Rocky Linux from CIQ Pro (RLC Pro) LTS 9.6 and 9.2 about three and a half hours after the PHP project released its PHP2Shell fix, covering a version upstream no longer supports.
CIQ built PHP 8.0.30 fixes from source-only upstream backports
The PHP project announced a critical security release the day before, disclosing only its severity. CIQ staffed up ahead of disclosure. The upstream fix went public just before 14:00 UTC, and within the hour the base PHP 8.0 fixes for both LTS releases were in review.
The project shipped fixed releases for PHP 8.2, 8.3, 8.4 and 8.5. For PHP 8.0 it published only "minimal source-backports" and no official binaries. RLC Pro LTS 9.6 and 9.2 ship PHP 8.0.30, so CIQ engineers built, tested and published php-8.0.30-3.4.el9_6_ciq for LTS 9.6 and php-8.0.30-1.2.el9_2_ciq for LTS 9.2.
Enterprise Linux 8 module streams receive uneven coverage
Enterprise Linux 8 ships PHP only as module streams, each with its own upstream fix status. The php:8.2 stream took the official 8.2.35 release. The php:7.4 stream needed a build from the source-only 7.4 fix branch. The php:7.2 stream has no upstream fix branch.
CIQ is not building PHP2Shell fixes for php:7.2, php:7.3 or php:8.0 on RLC Pro LTS 8.6 and 8.10, or for php:8.1 on LTS 9.2 and 9.6. Affected systems must move to php:7.4 or php:8.2 on Enterprise Linux 8, or to php:8.2 or php:8.3 on Enterprise Linux 9. Interim mitigations published by the PHP security team reduce exposure without removing it.
Rollout timing varied by release:
- RLC Pro 10, 9 and 8 received the Rocky Linux project's patched packages the next day.
- RLC Pro LTS 8.6 received fixed php:7.4 and php:8.2 builds the next day. Because php:8.2 is a new stream there, systems on other streams must switch to it.
- RLC Pro LTS 9.2 received fixed php:8.2 and php:8.3 streams three days after the upstream release.
On RLC Pro 8 and LTS 8.6, the packages are php-7.4.33-8 for php:7.4 and php-8.2.35 for php:8.2.
CIQ Bridge patches PHP 5.4 on CentOS 7.9 two days after upstream
The oldest branch the PHP project fixed, even as source only, is 7.4. CIQ engineers started from an existing community backport and adapted it to PHP 5.4, the version CentOS 7.9 ships. They released php-5.4.45-1.2.el7_9.ciqcbr for x86_64 two days after the upstream release. Hosts pick it up with a standard yum update from the CIQ Bridge repository, then a restart of PHP services.
CIQ Bridge delivers fixes for Critical and Important/High CVEs in a curated set of priority packages on CentOS 7.9 while customers migrate to RLC Pro or RLC Pro Hardened.
Spring kernel CVE work fed the PHP2Shell response
Before PHP2Shell, CIQ ran the same triage, backport and validation process against Linux kernel CVEs including Copy Fail, Dirty Frag, Fragnesia and CIFSwitch, plus the AI-found kernel vulnerabilities that followed. PHP2Shell carried that process into user space against remote code execution rather than local privilege escalation.
Administrators should verify patches with rpm -q php, which shows the patched package release. The php -v command does not, because backported builds keep the upstream version number. Customers still schedule updates, restart PHP services and rebuild container images on a fixed base.