As we all know, PHP 8.1 reached EOL on December 31, 2025, and the Gentoo PHP package maintainers, as usual, followed the upstream project’s line.
PHP releases often include fixes for CVEs, and once a release series reaches EOL, no further releases are published to address those vulnerabilities.
Until recently, even though some published CVEs were reproducible on PHP 8.1, upgrading was not strictly essential. However, with CVE-2026-109618 and CVE-2026-109619, I believe upgrading has become mandatory.
Unfortunately, I still have a few installations running PHP 8.1 because the software that requires it cannot be upgraded.
I imagine many other people are in the same situation, so I decided to publish this article to provide a practical solution.
All it took was resurrecting the latest php-8.1.x ebuild from the Gentoo Git repository and making a few minor changes to turn it into a live ebuild (9999) that uses Remi Collet’s repository.
Remi Collet is a PHP contributor who maintains repositories for EOL PHP branches, backporting security patches so that users can continue running older PHP versions without leaving them vulnerable to known security issues. He also packages PHP for RHEL-based distributions.
I’d like to take this opportunity to thank Remi for his great work.
For convenience, I’ve added the ebuild to my overlay, so anyone who wants to install a PHP 8.1 version containing backported security patches can do so with:
layman -a ago
emerge =php-8.1.9999A few things worth mentioning
1. Build environment
As of the time of writing, the ebuild builds successfully with a stable toolchain: gcc-16.2.1 and glibc-2.43-r4. I’ve also verified that the build succeeds with gcc-14.2.1 and glibc-2.42-r7.
2. Tests
src_test() pass successfully, however there are few unexpected failing tests that I’m investigating. In my view, a failing test can be an indication that software running in production may not be working as expected, so I strongly recommend enabling the tests.
3. Init system
The ebuild has been tested with OpenRC.
4. USE flags
Not all USE flag combinations have been tested, so enabling options different from the ones I used may cause the build to fail.
If you encounter a compilation failure, please report it to Remi Collet, as it is likely related to the PHP source code or its security patches.
If, on the other hand, you encounter an issue with the ebuild itself, please report it to me so I can investigate and make the necessary changes.
5. PHP_VERSION and the upstream commit
After installing php-8.1.9999, running:
php -r 'echo PHP_VERSION;'
will still output 8.1.34, because the version string is hardcoded here and here.
It would be nice if it printed something like 8.1.SHA or 8.1-SHA instead. Making this change in the ebuild would be trivial, but I don’t want to do it without a proper audit of where this string is used and whether it is involved in version comparisons or other operations.
If having the commit SHA in the version string is important to you, feel free to bring it up with Remi, who can decide whether to make the necessary changes to the repository.
Therefore, if you want to determine which commit your build was compiled from, you’ll have to use qlop -m to find the build date and then check the state of the php-src-security/PHP-8.1-security-backports repository at that time.
6. Older PHP versions
I don’t have any software that requires a PHP version older than 8.1, but if you do, you can apply the same approach in your own local repository by changing EGIT_BRANCH to point to whichever branch you need.
Keep in mind that different branches may require different build instructions, which you’ll need to adapt accordingly.
7. Backporting Gentoo ebuild changes
Although the ebuild worked out of the box and required no major modifications, since I decided to publish it and make it available to others, I also took the opportunity to backport some of the changes that the Gentoo PHP maintainers had made to ebuilds for versions newer than 8.1.
8. Keeping up with security updates
I recommend setting up a watch on the repository. Whenever a new commit introducing a security patch is published, you’ll need to rebuild and reinstall the package by running:
emerge =php-8.1.9999
This ensures that your installation picks up the latest available security patches.
That’s all.