Spent the day patching PHP2Shell (CVE-2026-109618/109619) on PHP 7.4.
No official release for EOL versions, so: pin the upstream backport, verify it byte for byte, recompile PHP from source inside Docker.
php -v still says 7.4.33. Trust nothing. Grep the binary. 🔍
#php…
the problem arises when the codebase is 10+ years old and the client doesn't want to pay for an upgrade. It happens a lot in Italian public administration projects