php56

No package exists yet in arch/ (not in adapted/, maintained/, owned/, or local-install/). AUR’s php56 (maintainer el_aur, same arch-phpbs family as [[php74]]/[[php85]]/[[php]], currently 5.6.40-14) is still unpatched for CVE-2026-109618/CVE-2026-109619 (“php2shell”) as of 2026-10-24.

AUR comment thread findings (2026-10-24)

• andreas_baumann (the user) already flagged this on the AUR page, 2026-10-22 07:57 UTC: “This package is not patched for php2shell (CVE-2026-109618 and CVE-2026-109619)!” – no response from el_aur since.
• drankinatty (2026-10-21, 2026-10-23): asked if a backport was planned, then noted the real PHP fix is too large to hand-port to 5.6 and suggested automated tooling; pointed at Anton Barinov’s repo as a possible shortcut since it provides patches back to 7.4 (actually 5.4, see below).
• severach (2026-10-23 16:20 UTC): linked https://github.com/Anton-Barinov/php2shell-patches, a Reddit thread, and a dev.to article on patching PHP 5.6-8.1 for php2shell via rebuilding RunCloud’s PHP.

Anton-Barinov/php2shell-patches reviewed and REJECTED for now (2026-10-24)

That repo ships five 5.6 variants: minimal, minimal-remicollet, community-backport, enhanced-universal, enhanced-remicollet. Unlike [[php74]]’s CVE patch (verified byte-identical to a real, git-formatted upstream PHP commit, 712e60f, real author metadata), none of the 5.6 patches have that provenance – plain diff -ruN files, no commit metadata, fabricated-looking uniform timestamps. PHP Group never officially patches anything pre-7.4, so there’s no ground truth to verify against.

Pulled and hand-reviewed the full minimal variant (288 lines, 5 files: Zend/zend_alloc.c, Zend/zend_alloc.h, ext/session/session.c, main/main.c, main/rfc1867.c) against real php-5.6.40 source. Found a real correctness bug present identically in all five variants (confirmed via diff – php_mime_should_save_hdr() and the multipart_buffer_headers() change are byte-for-byte the same shared boilerplate across every variant, so switching variants does not avoid it):

• The patch changes key = estrdup(line) in multipart_buffer_headers() (main/rfc1867.c) to only set key for Content-Disposition/ Content-Type headers (meant to cap memory use from attacker-supplied header spam per multipart part). But the pre-existing flush/reset logic (if (buf_value.c && key) { ...; buf_value.c = NULL; key = NULL; }) requires key to be non-NULL to fire. When a now-skipped header immediately precedes a saved header within the same multipart part, key is NULL at the skip step, so buf_value never gets reset – the next saved header’s value then gets the skipped header’s leftover text appended underneath it, corrupting the retained Content-Disposition/ Content-Type value (breaking filename=/name= parsing for that upload). The patch does correctly handle the trailing-skipped-header case (added a smart_str_free at loop end to avoid a leak) – it just missed this mid-sequence skip-then-save transition.
• Secondary, non-bug concern: zend_alloc.c’s rewrite of zend_mm_safe_error replaces the original per-request zend_try/zend_catch/zend_bailout() unwind with an unconditional _exit(1) – hard-kills the whole worker process on any call into that path, including the unrelated integer-overflow-in-allocation-size checks, not just real OOM. Bigger availability blast radius than the original, and removes the pre-existing re-entrancy guard rather than adapting it.

Decision (2026-10-24)

User’s call: hold off, wait for official/better-vetted patching rather than adopt Anton Barinov’s repo or hand-fix it ourselves right now. Not pursuing adapted/php56 until either el_aur backports it upstream on AUR, PHP’s own ecosystem produces something trustworthy for 5.6, or the user revisits this. If picked back up later: the minimal variant is still the right base (narrowest diff) but needs the buf_value reset bug fixed in multipart_buffer_headers() before use – don’t re-apply blind.