PHP source patches for 7.4, 8.0 and 8.1 explained

A PHP source patch is a change to PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. source code that an administrator incorporates into a custom build before using that installation.

If you are searching for a PHP 7.4 backport patch, you probably want to know what to do next. Start with whoever maintains PHP for your website. Ask whether they can supply a patched package or maintain a custom build.

Knowing a patch exists does not yet explain how your own site will receive the repair.

The php.net announcement says the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1. Some distributions and LTS vendors provide backported fixes. A source patch is one possible route.

Read how to backpatch PHPTo backpatch PHP is to apply a security fix to an older PHP version without moving the whole installation to a newer version. to compare it with a package update and an upgrade.

What did the PHP team publish?

The recorded fact describes minimal source changes for three old PHP versions. It does not identify a new regular release for those versions. Do not describe the patch as a new version number available from every host.

Ask your administrator which form of the repair is available and can be checked for your installation.

Older versions reach end of lifeEnd of life (EOL) means the makers have stopped looking after a version of software. It still works, but it no longer gets updates, not even security fixes.. The same facts source says PHP 8.1 and older no longer receive updates from the PHP project. The listed source patches do not turn that support status into a promise of future maintenance.

CISA advises taking systems on PHP 8.1 or older offline until patched or updated. The security status shows the recorded position.

A backportA backport takes a fix made for a newer version of software and applies it to an older version, so the old one gets the fix without a full upgrade. concerns a specific repair on an older base. Ask the administrator which issue the proposed build addresses and what falls outside the work. Keep the discussion focused on the fix, its source and the checks.

You do not need to reproduce an attack or collect exploitation details to make this decision.

Who should consider building from source?

Choose this route only if an administrator can own the build and its maintenance. Ask who will verify the source, manage the test environment and reverse the switch if needed. Record those responsibilities before work begins.

If nobody can take them on, return to the package route or discuss an upgrade.

If you only have a hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. account, use the hosting guides to establish the current version. Send your host a specific question about the available route. Treat a custom build as a separate piece of work with an agreed scope.

Establish what will be investigated and when someone will bring back a decision.

Check the source first

Have the administrator obtain the material from www.php.net. Ask them to verify the signature using PHP’s GPG information. Include the verification result in the work record.

If the origin is unclear or verification fails, stop before installation and have the administrator resolve that question first.

Keep references to the source code and patch used, with the date and php.net source. Ask the administrator to explain why that combination fits your installation. This lets a future administrator understand what was built.

A file name without its origin is not enough to document the choice for later maintenance.

Build separately and test before switching

Have the build installed into its own prefix, a separate installation location alongside the existing one. Agree a rollbackA rollback means going back to the last version of your website that worked, after an update has gone wrong. plan first. Keep the current installation intact during the trial.

This article does not prescribe build options: the administrator needs to justify and check the plan for your particular environment.

Start by checking a test copy of the website on the new build. Agree a short list of tasks that need to work, such as signing in, searching, submitting forms and carrying out key administration tasks. Have the person doing the work record the results.

Opening the homepage does not cover the full use of your website.

Only then plan a possible switch. Name the person allowed to make the change and the person who will check the website immediately afterwards. Record which results require rollback and how the administrator will report them.

After switching, also request confirmation of the installation now serving the domainA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted.. Save that answer with the test record.

Plan the maintenance as well

Ask who will maintain the custom build after this repair. Set a time to review whether this route still fits. Use the supported PHP versions page when discussing the next version.

Completing a build is a different decision from remaining on the same base for the longer term.

To prepare that move, discuss a PHP upgrade with your administrator. Ask which information is needed to assess the site. Keep the build records available so the next administrator can understand the changes.

That connects the upgrade plan to the installation actually in use, with a clear starting point for testing and ownership.

Not sure which route fits?

Start with the PHP Exposure Check. Then use the help form, including your PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., hosting provider and who manages the server. Say whether someone has already proposed a package or custom build.

Do not share login details. The first task is choosing a route someone can carry out.