Spent the day patching PHP2Shell (CVE-2026-109618/109619) on PHP 7.4.
No official release for EOL versions, so: pin the upstream backport, verify it byte for byte, recompile PHP from source inside Docker.
php -v still says 7.4.33. Trust nothing. Grep the binary. 🔍
#php…