We still have a server on CentOS 7.9 with ISPmanager 6, and the sites run on the PHP versions that ISPmanager installs and manages.

After the PHP RCE fixes on Oct 21 (fixed versions 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12) we are not sure what the right path is on this setup:

- has ISPsystem pushed patched PHP packages for ISPmanager 6 on EL7, or does it only get them on newer OS versions?

- if not, did anyone build the fixed PHP from source and plug it into ISPmanager as an alternative PHP version without breaking the panel?

- for the older branches, php.net mentions source backport branches for 7.4, 8.0 and 8.1 in php-src. has anyone used those with ISPmanager?

- where do you set the interim settings from the php.net advisory (session.upload_progress.enabled=0, memory_limit=-1) so ISPmanager does not overwrite them?

We know moving off CentOS 7 is the real fix and it is planned, but we need to close this first. Any real experience with ISPmanager here is welcome, thanks.