Still have a server running with Debian 11 and PHP 7.4.33 and are looking for a patched set of Debian packages to in the short term fix the recent CVE-2026-109618 and CVE-2026-109619 finding?
The easy way could be to checkout sury.org and use their repo https://packages.sury.org/php/ Checkout the Readme.txt and you should quickly have updates from a platform which keeps more updates then I do.
But I went the other way, because I like a challenge and to do it my own way 🙂 . I downloaded the PHP 7.4 CVE branch which the PHP devs provided. I then made a diff between the last PHP 7.4.33 sources to see what changes were made to this PHP branch to secure it against exploits described in CVE-2026-109618 and CVE-2026-109619.
Next I wanted to build a Debian 11 package like it would have come from security.debian.org. So I downloaded the last released Debian source package for php7.4 and extracted it. I applied that patch and fix a few issues as the patch command was not able to apply it fully. I then updated the debian changelog file and added that it fixes the CVEs and then let it build a new package: php7.4-7.4.33-1+deb11u13
So here is a downloadable tar with patched packages in a sub-folder: Download php7.4-7.4.33-1+deb11u13.tar.gz \
It should install the packages with the +dev11u13 extension in line with the Debian packaging mantra.
To validate the pakcages here are md5sums:45b0eab43714b6eb5f9ae4337f49aa2a libapache2-mod-php7.4_7.4.33-1+deb11u13_amd64.deb
09751831c72a400fac94a7522c5eccad libphp7.4-embed_7.4.33-1+deb11u13_amd64.deb
eceb998bc6185f645891e93d8705a671 php7.4_7.4.33-1+deb11u13_all.deb
39266ce981e033e8dc68c04a5993a49b php7.4-bcmath_7.4.33-1+deb11u13_amd64.deb
d5df81c794be2b476fa73beabb513dee php7.4-bz2_7.4.33-1+deb11u13_amd64.deb
76e2cc1d52e02c9132c43c3ddca362ae php7.4-cgi_7.4.33-1+deb11u13_amd64.deb
5375b91e0b36f26bcaf5b468bf0fecb0 php7.4-cli_7.4.33-1+deb11u13_amd64.deb
fc348e81989d57e7a14bae9db93cff4f php7.4-common_7.4.33-1+deb11u13_amd64.deb
f9ee2419547b6eca8ed377ae59e09b4e php7.4-curl_7.4.33-1+deb11u13_amd64.deb
c94fb70e75d684c032944097d2965695 php7.4-dba_7.4.33-1+deb11u13_amd64.deb
6a8472c7759731730cd20cebe6e366ec php7.4-dev_7.4.33-1+deb11u13_amd64.deb
156c157aa35a9361464241199e41e382 php7.4-enchant_7.4.33-1+deb11u13_amd64.deb
f7dd8bf204ee78e78dc1a3ed44cc70ef php7.4-fpm_7.4.33-1+deb11u13_amd64.deb
41425419ccb8f0abe58429c4dc205ae3 php7.4-gd_7.4.33-1+deb11u13_amd64.deb
0f70f363c6f0d06eab1bd2a7c28bc314 php7.4-gmp_7.4.33-1+deb11u13_amd64.deb
bd1e04743b5a00d9aa55e037e261e2e6 php7.4-imap_7.4.33-1+deb11u13_amd64.deb
3580874b8e2949b4b65f47d4836ef15f php7.4-interbase_7.4.33-1+deb11u13_amd64.deb
17b65a44d222e3e41bc762a631e6db8d php7.4-intl_7.4.33-1+deb11u13_amd64.deb
a259feca58879a1af3db214e01f676da php7.4-json_7.4.33-1+deb11u13_amd64.deb
decb6281ac4c77ae7faeddc44a57371f php7.4-ldap_7.4.33-1+deb11u13_amd64.deb
cbb555df033218d9c8af19bb371882d4 php7.4-mbstring_7.4.33-1+deb11u13_amd64.deb
44cc3d187bffcf06d25898267a25e40a php7.4-mysql_7.4.33-1+deb11u13_amd64.deb
88caf4c3849443cf78e37bf80c962761 php7.4-odbc_7.4.33-1+deb11u13_amd64.deb
d030ef5550049ed78c18de7641f7ab2c php7.4-opcache_7.4.33-1+deb11u13_amd64.deb
1ff2fa5b26258aa67fcbc43f8acff910 php7.4-pgsql_7.4.33-1+deb11u13_amd64.deb
b4236f81ae0083029a35786023075851 php7.4-phpdbg_7.4.33-1+deb11u13_amd64.deb
41c92f2f19ffd7e36c2c794bb5e47446 php7.4-pspell_7.4.33-1+deb11u13_amd64.deb
3d1833291fa0178035e478ae4c5684c0 php7.4-readline_7.4.33-1+deb11u13_amd64.deb
50e418e61223614072119a629e31440f php7.4-snmp_7.4.33-1+deb11u13_amd64.deb
ea620c06e5e554c7afb761bad93c390e php7.4-soap_7.4.33-1+deb11u13_amd64.deb
7438022fa6dab38a6f0c8c70a370c98e php7.4-sqlite3_7.4.33-1+deb11u13_amd64.deb
64e6576d476a9e2e643a2a6dcb402996 php7.4-sybase_7.4.33-1+deb11u13_amd64.deb
80f76703126bd360b3890bcec3ce7842 php7.4-tidy_7.4.33-1+deb11u13_amd64.deb
ef96e78e28d4f215ffb7ac1277dd5b84 php7.4-xml_7.4.33-1+deb11u13_amd64.deb
409c0ebac81f432e31c8420c173ac865 php7.4-xmlrpc_7.4.33-1+deb11u13_amd64.deb
c58755d656b3577b4f69a5d6d5a126c3 php7.4-xsl_7.4.33-1+deb11u13_all.deb
cfce1d403d7ae06aff5dd39686c82bfc php7.4-zip_7.4.33-1+deb11u13_amd64.deb