NixOS: Quick fix for PHP CVE-2026-109618 and CVE-2026-109619
php2shell
PHP disclosed two CVSS 9.2 unauthenticated RCE vulnerabilities on 21 October 2026, with exploitation expected within minutes. Patched releases like PHP 8.3.36 or PHP 8.4.27 were available immediately, but nixpkgs takes days to catch up: PR, review, Hydra rebuild of PHP and its reverse dependencies, channel advance...
Use an overlay to get an immidiate fix
An overlay swaps only the PHP source.