catiexlyra/GalaxyPHP
Watch
2
0
Fork
You've already forked GalaxyPHP
 0
Code Issues Pull requests Releases Activity
Maintained PHP source releases, security backports and hardened runtime builds from PHP 5.6 through current. Per-version qualification is explicit.
1 commit 1 branch 0 tags 150 MiB
  • C 68.4%
  • PHP 29.6%
  • M4 0.5%
  • C++ 0.5%
  • Shell 0.3%
  • Other 0.3%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Lyra c771b8d810 Import latest PHP 5.6–8.5 sources and explicit security backport status
2026-10-22 16:29:06 -04:00
security Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00
tools Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00
versions Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00
.gitignore Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00
AGENTS.md Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00
project.json Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00
README.md Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00
SUPPORT-MATRIX.json Import latest PHP 5.6–8.5 sources and explicit security backport status 2026-10-22 16:29:06 -04:00

README.md

GalaxyPHP

Maintained PHP source, security backports and hardened runtime packaging from Catie × Lyra. One repository holds the latest release of every selected PHP series, with separate source and patch records for each version.

The maintenance project starts at 0.1.0. Upstream PHP versions retain their original numbering. A source folder is not a qualified binary release: consult SUPPORT-MATRIX.json and the version's SOURCE.json for the actual state.

PHP series Target version Source folder
5.6 5.6.40 5.6.40
7.0 7.0.33 7.0.33
7.1 7.1.33 7.1.33
7.2 7.2.34 7.2.34
7.3 7.3.33 7.3.33
7.4 7.4.33 7.4.33
8.0 8.0.30 8.0.30
8.1 8.1.34 8.1.34
8.2 8.2.35 8.2.35
8.3 8.3.36 8.3.36
8.4 8.4.27 8.4.27
8.5 8.5.12 8.5.12

Each folder contains the actual source in src/, preserved patches in patches/ where applicable, and an exact upstream archive identity. The PHP 7.4/8.0/8.1 folders apply the PHP team's published emergency backports. PHP 8.2–8.5 use the fixed upstream releases. PHP 5.6–7.3 backports are still being developed and reviewed; those source baselines must not be distributed as protected binaries.

See the security work record. Qualification includes both vulnerability families, real serving behaviour, uploads and session handling, OOM and fatal-error recovery, runtime ABI/modules, relocatable packaging, notices, signed installer metadata and independent mirror downloads. Hardening settings are recorded with build evidence; configuration-only mitigations do not establish complete CVE coverage.

PHP remains upstream PHP. Its licence and the licences of bundled components remain alongside their source. Maintenance tooling has its own notices. End-of-life versions do not become generally supported or free of other vulnerabilities through these two backports.