NixOS: Quick fix for PHP CVE-2026-109618 and CVE-2026-109619
PHP disclosed two CVSS 9.2 unauthenticated RCE vulnerabilities on 21 October 2026, with exploitation expected within minutes. Patched releases like 8.3.36, 8.4.27 were available immediately, but nixpkgs takes days to catch up: PR, review, Hydra rebuild of PHP and its reverse dependencies, channel advance. Our flake pins a nixpkgs commit, so waiting also means bumping the pin and rebuilding everything else.
An overlay swaps only the PHP source.