The day after PHP2Shell (CVE-2026-109618 and CVE-2026-109619) went public, we shipped patched PHP 5.6, 7.0, 7.3 and 8.0 for CentOS 7. I wrote up how those first backports were ported and proven . This is the follow-up: getting from "the versions we had time for" to every PHP a CentOS 7 box can run, 5.6 through 8.4, in both of Remi's package shapes.

The real problem was the matrix, not the patch

Once the fix was ported to 5.6 and 7.0, the hard engineering was done. What was left was combinatorics:

11 PHP versions (5.6, 7.0 to 7.4, 8.0 to 8.4)

2 package shapes per version: Remi's base-name php-* (replaces system PHP, from remi-phpNN ) and the phpNN-php-* software collection (side by side, from remi-safe )

a different starting point per version: a frozen EL7 build, a maintained EL8+ source, or plain upstream

Doing that as 11 separate packaging repos meant 11 copies of the same build glue drifting apart.…