{"id":757,"date":"2026-10-22T12:29:06","date_gmt":"2026-10-22T12:29:06","guid":{"rendered":"https:\/\/www.kwenie.com\/?p=757"},"modified":"2026-10-22T12:35:34","modified_gmt":"2026-10-22T12:35:34","slug":"debian-11-php-7-4-33","status":"publish","type":"post","link":"https:\/\/www.kwenie.com\/index.php\/2026\/10\/22\/debian-11-php-7-4-33\/","title":{"rendered":"Debian 11 – PHP 7.4.33"},"content":{"rendered":"\n

Still have a server running with Debian 11 and PHP 7.4.33 and are looking for a patched set of Debian packages to in the short term fix the recent CVE-2026-109618 and CVE-2026-109619 finding?<\/p>\n\n\n\n

The easy way could be to checkout sury.org and use their repo https:\/\/packages.sury.org\/php\/<\/a> Checkout the Readme.txt and you should quickly have updates from a platform which keeps more updates then I do.<\/p>\n\n\n\n

But I went the other way, because I like a challenge and to do it my own way \ud83d\ude42 . I downloaded the PHP 7.4 CVE branch <\/a> which the PHP devs provided. I then made a diff between the last PHP 7.4.33 sources to see what changes were made to this PHP branch to secure it against exploits described in CVE-2026-109618 and CVE-2026-109619. <\/p>\n\n\n\n

Next I wanted to build a Debian 11 package like it would have come from security.debian.org. So I downloaded the last released Debian source package for php7.4 and extracted it. I applied that patch and fix a few issues as the patch command was not able to apply it fully. I then updated the debian changelog file and added that it fixes the CVEs and then let it build a new package: php7.4-7.4.33-1+deb11u13<\/p>\n\n\n\n

So here is a downloadable tar with patched packages in a sub-folder: Download php7.4-7.4.33-1+deb11u13.tar.gz<\/a> \\<\/p>\n\n\n\n

It should install the packages with the +dev11u13 extension in line with the Debian packaging mantra.<\/p>\n\n\n\n

To validate the pakcages here are md5sums:
45b0eab43714b6eb5f9ae4337f49aa2a \u00a0libapache2-mod-php7.4_7.4.33-1+deb11u13_amd64.deb
09751831c72a400fac94a7522c5eccad \u00a0libphp7.4-embed_7.4.33-1+deb11u13_amd64.deb
eceb998bc6185f645891e93d8705a671 \u00a0php7.4_7.4.33-1+deb11u13_all.deb
39266ce981e033e8dc68c04a5993a49b \u00a0php7.4-bcmath_7.4.33-1+deb11u13_amd64.deb
d5df81c794be2b476fa73beabb513dee \u00a0php7.4-bz2_7.4.33-1+deb11u13_amd64.deb
76e2cc1d52e02c9132c43c3ddca362ae \u00a0php7.4-cgi_7.4.33-1+deb11u13_amd64.deb
5375b91e0b36f26bcaf5b468bf0fecb0 \u00a0php7.4-cli_7.4.33-1+deb11u13_amd64.deb
fc348e81989d57e7a14bae9db93cff4f \u00a0php7.4-common_7.4.33-1+deb11u13_amd64.deb
f9ee2419547b6eca8ed377ae59e09b4e \u00a0php7.4-curl_7.4.33-1+deb11u13_amd64.deb
c94fb70e75d684c032944097d2965695 \u00a0php7.4-dba_7.4.33-1+deb11u13_amd64.deb
6a8472c7759731730cd20cebe6e366ec \u00a0php7.4-dev_7.4.33-1+deb11u13_amd64.deb
156c157aa35a9361464241199e41e382 \u00a0php7.4-enchant_7.4.33-1+deb11u13_amd64.deb
f7dd8bf204ee78e78dc1a3ed44cc70ef \u00a0php7.4-fpm_7.4.33-1+deb11u13_amd64.deb
41425419ccb8f0abe58429c4dc205ae3 \u00a0php7.4-gd_7.4.33-1+deb11u13_amd64.deb
0f70f363c6f0d06eab1bd2a7c28bc314 \u00a0php7.4-gmp_7.4.33-1+deb11u13_amd64.deb
bd1e04743b5a00d9aa55e037e261e2e6 \u00a0php7.4-imap_7.4.33-1+deb11u13_amd64.deb
3580874b8e2949b4b65f47d4836ef15f \u00a0php7.4-interbase_7.4.33-1+deb11u13_amd64.deb
17b65a44d222e3e41bc762a631e6db8d \u00a0php7.4-intl_7.4.33-1+deb11u13_amd64.deb
a259feca58879a1af3db214e01f676da \u00a0php7.4-json_7.4.33-1+deb11u13_amd64.deb
decb6281ac4c77ae7faeddc44a57371f \u00a0php7.4-ldap_7.4.33-1+deb11u13_amd64.deb
cbb555df033218d9c8af19bb371882d4 \u00a0php7.4-mbstring_7.4.33-1+deb11u13_amd64.deb
44cc3d187bffcf06d25898267a25e40a \u00a0php7.4-mysql_7.4.33-1+deb11u13_amd64.deb
88caf4c3849443cf78e37bf80c962761 \u00a0php7.4-odbc_7.4.33-1+deb11u13_amd64.deb
d030ef5550049ed78c18de7641f7ab2c \u00a0php7.4-opcache_7.4.33-1+deb11u13_amd64.deb
1ff2fa5b26258aa67fcbc43f8acff910 \u00a0php7.4-pgsql_7.4.33-1+deb11u13_amd64.deb
b4236f81ae0083029a35786023075851 \u00a0php7.4-phpdbg_7.4.33-1+deb11u13_amd64.deb
41c92f2f19ffd7e36c2c794bb5e47446 \u00a0php7.4-pspell_7.4.33-1+deb11u13_amd64.deb
3d1833291fa0178035e478ae4c5684c0 \u00a0php7.4-readline_7.4.33-1+deb11u13_amd64.deb
50e418e61223614072119a629e31440f \u00a0php7.4-snmp_7.4.33-1+deb11u13_amd64.deb
ea620c06e5e554c7afb761bad93c390e \u00a0php7.4-soap_7.4.33-1+deb11u13_amd64.deb
7438022fa6dab38a6f0c8c70a370c98e \u00a0php7.4-sqlite3_7.4.33-1+deb11u13_amd64.deb
64e6576d476a9e2e643a2a6dcb402996 \u00a0php7.4-sybase_7.4.33-1+deb11u13_amd64.deb
80f76703126bd360b3890bcec3ce7842 \u00a0php7.4-tidy_7.4.33-1+deb11u13_amd64.deb
ef96e78e28d4f215ffb7ac1277dd5b84 \u00a0php7.4-xml_7.4.33-1+deb11u13_amd64.deb
409c0ebac81f432e31c8420c173ac865 \u00a0php7.4-xmlrpc_7.4.33-1+deb11u13_amd64.deb
c58755d656b3577b4f69a5d6d5a126c3 \u00a0php7.4-xsl_7.4.33-1+deb11u13_all.deb
cfce1d403d7ae06aff5dd39686c82bfc \u00a0php7.4-zip_7.4.33-1+deb11u13_amd64.deb<\/code>
<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Still have a server running with Debian 11 and PHP 7.4.33 and are looking for a patched set of Debian packages to in the short term fix the recent CVE-2026-109618 and CVE-2026-109619 finding? The easy way could be to checkout sury.org and use their repo https:\/\/packages.sury.org\/php\/ Checkout the Readme.txt and you should quickly have updates […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[12,13,14,11],"class_list":["post-757","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-cve-2026-109618","tag-cve-2026-109619","tag-debian-11","tag-php"],"_links":{"self":[{"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/posts\/757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/comments?post=757"}],"version-history":[{"count":0,"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/posts\/757\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/media?parent=757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/categories?post=757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kwenie.com\/index.php\/wp-json\/wp\/v2\/tags?post=757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}