我对 PHP 5.4 修复 CVE-2026-109618 和 CVE-2026-109619 的过程
1 、下载： 从 https://museum.php.net/php5/php-5.4.45.tar.gz 下载 PHP 5.4 的最新版本，从 https://github.com/vperetti/php-cve-2026-109618-109619-backports 下载 patch 文件
2 、打补丁： 将 php-5.4.45 目录 php-5.4-CVE-2026-109618-109619.patch 文件 放到同一个目录下，进入 php-5.4.45 目录，然后 patch -p1 < ../php-5.4-CVE-2026-109618-109619.patch
3 、配置编译参数： 在原来的 PHP 5.4 里，php -i | grep Configure 看到编译参数，比如我的是 ./configure –prefix=/www/server/php/54 –with-config-file-path=/www/server/php/54/etc –enable-fpm –with-fpm-user=www –with-fpm-group=www –with-mysql=mysqlnd –with-mysqli=mysqlnd –with-pdo-mysql=mysqlnd –with-iconv-dir –with-freetype-dir=/usr/local/freetype –with-jpeg-dir –with-png-dir –with-zlib –with-libxml-dir=/usr –enable-xml –disable-rpath –enable-bcmath –enable-shmop –enable-sysvsem –enable-inline-optimization –with-curl=/usr/local/curl –enable-mbregex –enable-mbstring –with-mcrypt –enable-ftp –with-gd –enable-gd-native-ttf –with-openssl=/usr/local/openssl –with-mhash –enable-pcntl –enable-sockets –with-xmlrpc –enable-zip –enable-soap –with-gettext –disable-fileinfo –enable-intl –build=arm-linux
4 、编译： 然后通过 make -j$(nproc) 进行编译 我的是 4 核，也可以 make -j3 ，这样留给其他程序一点 CPU 资源
5 、停止原来的 PHP-FPM ，并备份原来的目录
6 、安装： make install
会输出 Installing PHP CLI binary: /www/server/php/54/bin/ Installing PHP CLI man page: /www/server/php/54/php/man/man1/ Installing PHP FPM binary: /www/server/php/54/sbin/ Installing PHP FPM config: /www/server/php/54/etc/ Installing PHP FPM man page: /www/server/php/54/php/man/man8/ Installing PHP FPM status page: /www/server/php/54/php/fpm/ Installing PHP CGI binary: /www/server/php/54/bin/ Installing PHP CGI man page: /www/server/php/54/php/man/man1/ Installing build environment: /www/server/php/54/lib/php/build/ Installing header files: /www/server/php/54/include/php/ Installing helper programs: /www/server/php/54/bin/ program: phpize program: php-config Installing man pages: /www/server/php/54/php/man/man1/ page: phpize.1 page: php-config.1 Installing PEAR environment: /www/server/php/54/lib/php/ [PEAR] Archive_Tar - already installed: 1.3.12 [PEAR] Console_Getopt - already installed: 1.3.1 [PEAR] Structures_Graph- already installed: 1.0.4 [PEAR] XML_Util - already installed: 1.2.3 [PEAR] PEAR - already installed: 1.9.5 Warning! a PEAR user config file already exists from a previous PEAR installation at ‘/root/.pearrc’. You may probably want to remove it. Wrote PEAR system config file at: /www/server/php/54-patch/etc/pear.conf You may want to add: /www/server/php/54/lib/php to your php.ini include_path /www/server/php/php-5.4.45/build/shtool install -c ext/phar/phar.phar /www/server/php/54/bin ln -s -f /www/server/php/54/bin/phar.phar /www/server/php/54/bin/phar Installing PDO headers: /www/server/php/54/include/php/ext/pdo/
如果原来的 php.ini 修改了的，就复制到新的里面
7 、重新启动 PHP-FPM
./configure 的时候配置到其他目录，比如 –prefix=/www/server/php/54-patch ，那么日志等会写入到这个目录里，启动的时候会报错，会写入到 /www/server/php/54-patch/var/log/slow.log ，中间目录不存在。 而且通过 phpinfo 看到 extension_dir /www/server/php/54-patch/lib/php/extensions/no-debug-non-zts-20100525 include_path .:/www/server/php/54-patch/lib/php
所以还是直接 –prefix=/www/server/php/54 即可，在 make install 直接备份原目录并停止旧的 PHP-FPM 进程
不知道能不能抵御漏洞，反正重新编译后的 PHP 5.4 能正常运行
第 3 步的 php -i | grep Configure 的输出是 Configure Command => ‘./configure’ ‘–prefix=/www/server/php/54’ ‘–with-config-file-path=/www/server/php/54/etc’ ‘–enable-fpm’ ‘–with-fpm-user=www’ ‘–with-fpm-group=www’ ‘–with-mysql=mysqlnd’ ‘–with-mysqli=mysqlnd’ ‘–with-pdo-mysql=mysqlnd’ ‘–with-iconv-dir’ ‘–with-freetype-dir=/usr/local/freetype’ ‘–with-jpeg-dir’ ‘–with-png-dir’ ‘–with-zlib’ ‘–with-libxml-dir=/usr’ ‘–enable-xml’ ‘–disable-rpath’ ‘–enable-bcmath’ ‘–enable-shmop’ ‘–enable-sysvsem’ ‘–enable-inline-optimization’ ‘–with-curl=/usr/local/curl’ ‘–enable-mbregex’ ‘–enable-mbstring’ ‘–with-mcrypt’ ‘–enable-ftp’ ‘–with-gd’ ‘–enable-gd-native-ttf’ ‘–with-openssl=/usr/local/openssl’ ‘–with-mhash’ ‘–enable-pcntl’ ‘–enable-sockets’ ‘–with-xmlrpc’ ‘–enable-zip’ ‘–enable-soap’ ‘–with-gettext’ ‘–disable-fileinfo’ ‘–enable-intl’ ‘–build=arm-linux’
带有引号的，复制到 AI 对话框里，让 AI 处理一下就好