diff --git a/.config b/.config
index d20d479..4ae5848 100644
--- a/.config
+++ b/.config
@@ -138,17 +138,18 @@ BR2_TOOLCHAIN_BUILDROOT_LIBC="glibc"
 #
 # Kernel Header Options
 #
-BR2_KERNEL_HEADERS_AS_KERNEL=y
+# BR2_KERNEL_HEADERS_AS_KERNEL is not set
 # BR2_KERNEL_HEADERS_5_4 is not set
 # BR2_KERNEL_HEADERS_5_10 is not set
 # BR2_KERNEL_HEADERS_5_15 is not set
 # BR2_KERNEL_HEADERS_6_1 is not set
 # BR2_KERNEL_HEADERS_6_6 is not set
-# BR2_KERNEL_HEADERS_6_12 is not set
+BR2_KERNEL_HEADERS_6_12=y
 # BR2_KERNEL_HEADERS_VERSION is not set
 # BR2_KERNEL_HEADERS_CUSTOM_TARBALL is not set
 # BR2_KERNEL_HEADERS_CUSTOM_GIT is not set
 BR2_KERNEL_HEADERS_LATEST=y
+BR2_DEFAULT_KERNEL_HEADERS="6.12.104"
 BR2_PACKAGE_HOST_LINUX_HEADERS_LICENSE_FILES="COPYING LICENSES/preferred/GPL-2.0 LICENSES/exceptions/Linux-syscall-note"
 BR2_PACKAGE_LINUX_HEADERS=y
 BR2_PACKAGE_MUSL_ARCH_SUPPORTS=y
@@ -485,15 +486,16 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT_ARGS=""
 # Kernel
 #
 BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_LATEST_VERSION=y
+# BR2_LINUX_KERNEL_LATEST_VERSION is not set
 # BR2_LINUX_KERNEL_LATEST_CIP_VERSION is not set
 # BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION is not set
-# BR2_LINUX_KERNEL_CUSTOM_VERSION is not set
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 # BR2_LINUX_KERNEL_CUSTOM_TARBALL is not set
 # BR2_LINUX_KERNEL_CUSTOM_GIT is not set
 # BR2_LINUX_KERNEL_CUSTOM_HG is not set
 # BR2_LINUX_KERNEL_CUSTOM_SVN is not set
-BR2_LINUX_KERNEL_VERSION="6.12.104"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.114"
+BR2_LINUX_KERNEL_VERSION="6.12.114"
 BR2_LINUX_KERNEL_LICENSE_FILES="COPYING LICENSES/preferred/GPL-2.0 LICENSES/exceptions/Linux-syscall-note"
 BR2_LINUX_KERNEL_PATCH=""
 BR2_LINUX_KERNEL_USE_DEFCONFIG=y
@@ -1262,7 +1264,7 @@ BR2_PACKAGE_QT6_ARCH_SUPPORTS=y
 # BR2_PACKAGE_BRLTTY is not set
 
 #
-# cc-tool needs a toolchain w/ C++, threads, wchar, gcc >= 4.9 
+# cc-tool needs a toolchain w/ C++, threads, wchar, gcc >= 4.9
 #
 # BR2_PACKAGE_CDRKIT is not set
 # BR2_PACKAGE_CRUCIBLE is not set
@@ -4587,35 +4589,35 @@ BR2_PACKAGE_TRACEROUTE=y
 #
 
 #
-# Please note:                                           
+# Please note:
 #
 
 #
-# - Buildroot does *not* generate binary packages,       
+# - Buildroot does *not* generate binary packages,
 #
 
 #
-# - Buildroot does *not* install any package database.   
+# - Buildroot does *not* install any package database.
 #
 
 #
-# *                                                      
+# *
 #
 
 #
-# It is up to you to provide those by yourself if you    
+# It is up to you to provide those by yourself if you
 #
 
 #
-# want to use any of those package managers.             
+# want to use any of those package managers.
 #
 
 #
-# *                                                      
+# *
 #
 
 #
-# See the manual:                                        
+# See the manual:
 #
 
 #
@@ -6149,3 +6151,5 @@ BR2_TARGET_UBOOT_CUSTOM_PATCH_DIR=""
 # BR2_BINUTILS_VERSION_2_22 is not set
 # BR2_PACKAGE_GPU_VIV_BIN_MX6Q is not set
 # BR2_TARGET_UBOOT_NETWORK is not set
+
+
diff --git a/README.md b/README.md
index 91faec4..cdee930 100644
--- a/README.md
+++ b/README.md
@@ -13,8 +13,7 @@ disk installer (`mentalnet-install`).
 
 ## Current release
 
-**R1 "StreamingHeart"** — named after DECO*27's *ストリーミングハート
-(Streaming Heart)*, feat. Hatsune Miku.
+**R1 "Ochatime"** — named after 23.exe's *Ochatime*.
 
 ## Versioning
 
@@ -29,7 +28,8 @@ disk installer (`mentalnet-install`).
 | R1 | Mesmerizer | *Mesmerizer* — 32ki (Hatsune Miku & Kasane Teto) | Initial release |
 | R1 | FirstStorm | *Chūlán ~First Storm~ (初嵐～First Storm～)* — DECO*27 | Swap-free installer, true i586 support, terminal/input hardening, interrupt-storm fixes |
 | R1 | LovePara | *ラブパラ (Love Para)* — DECO*27 feat. Hatsune Miku | app-server stack (PHP/Ruby/Perl, php-fpm, lighttpd `/proxy/` → port 1337), tcc on-target C dev with glibc headers, socat, gesftpserver, SiS 900 / VIA Rhine / Tigon3 NICs, fastfetch, nano, en_US.UTF-8 locale |
-| R1 | **StreamingHeart** | *ストリーミングハート (Streaming Heart)* — DECO*27 feat. Hatsune Miku | **Current** — `runmain.o` for tcc (run C files like scripts without permanent compilation), tmux, custom bash prompt |
+| R1 | StreamingHeart | *ストリーミングハート (Streaming Heart)* — DECO*27 feat. Hatsune Miku | `runmain.o` for tcc (run C files like scripts without permanent compilation), tmux, custom bash prompt |
+| R1 | **Ochatime** | *Ochatime* — 23.exe | **Current** — Linux 6.12.114 (PwnEscape/CVE-2026-99999 fix), PHP 8.3.36 security update (*php2shell*, CVE-2026-109618 / CVE-2026-109619), eMudhra (emSign) root CAs purged from the trust store |
 
 ## Quick facts
 
@@ -37,7 +37,7 @@ disk installer (`mentalnet-install`).
 |---|---|
 | Login | `root` / `mnlinux` |
 | Hostname | `mentalnet` |
-| Kernel | `6.12.104-mentalnet-intel32` |
+| Kernel | `6.12.114-mentalnet-intel32` |
 | Media | Live CD with built-in installer |
 | CPU | i586 (Pentium / Pentium MMX) or any newer x86 |
 | RAM | 128 MB minimum (64 MB usually works) |
@@ -158,4 +158,3 @@ full fork.
 The OS image produced by the build is an aggregation of many
 components, each of which keeps its own license (the Linux kernel is
 GPL-2.0, BusyBox is GPL-2.0, and so on).
-
diff --git a/board/mentalnet/INSTALL-GUIDE.md b/board/mentalnet/INSTALL-GUIDE.md
index cdc2127..d529aa3 100644
--- a/board/mentalnet/INSTALL-GUIDE.md
+++ b/board/mentalnet/INSTALL-GUIDE.md
@@ -5,7 +5,7 @@ Pentium-class PCs, built with Buildroot 2025.02.17. The ISO is a live
 CD: the entire system runs from the CD with a read-only root, and the
 same CD carries a built-in hard disk installer (`mentalnet-install`).
 
-- Kernel: `6.12.104-mentalnet-intel32` (slimmed i386 config)
+- Kernel: `6.12.114-mentalnet-intel32` (slimmed i386 config)
 - Login: `root` / `mnlinux`
 - Hostname: `mentalnet`
 - Live CD size: ~100 MB
diff --git a/board/mentalnet/post-build.sh b/board/mentalnet/post-build.sh
index be47282..6bb2178 100755
--- a/board/mentalnet/post-build.sh
+++ b/board/mentalnet/post-build.sh
@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # post-build.sh - stamp the Mentalnet root filesystem with a build id
+#                  and scrub compromised CAs from the trust store
 #
 # Invoked by Buildroot (BR2_ROOTFS_POST_BUILD_SCRIPT) with the target
 # directory as first argument. The same stamp is recorded in
@@ -18,9 +19,9 @@ set -e
 TARGET_DIR="${1}"
 #STAMP="$(date +%Y%m%d-%H%M%S)"
 RELEASE="R1"
-CODENAME="StreamingHeart"
-STAMP="${RELEASE} ${CODENAME}"        # pretty form: R1 ${CODENAME}
-STAMP_SAFE="${RELEASE}-${CODENAME}"       # sanitized:  R1-GhostRule
+CODENAME="Ochatime"
+STAMP="${RELEASE} ${CODENAME}"        # pretty form: R1 Ochatime
+STAMP_SAFE="${RELEASE}-${CODENAME}"       # sanitized:  R1-Ochatime
 IMAGES_DIR="$(dirname "${TARGET_DIR}")/images"
 
 # record the stamp for post-image.sh
@@ -43,3 +44,37 @@ EOF
 ISSUE="${TARGET_DIR}/etc/issue"
 sed -i '/^Mentalnet GNU\/Linux build /d' "${ISSUE}"
 printf 'Mentalnet GNU/Linux build %s\n' "${STAMP}" >> "${ISSUE}"
+
+# Remove the eMudhra (emSign) root CAs and rebuild the trust store.
+#
+# Background: R1 Ochatime security response (October 2026) - eight
+# eMudhra intermediate CA keys were compromised (EM DV/OV/EV TLS and
+# EM OV/OV CS code-signing authorities, e.g. CVE-2026-111943). The
+# Debian/Mozilla trust store in this build does not ship intermediates,
+# but it does trust the four eMudhra emSign roots below; drop them so
+# nothing chaining under eMudhra can validate here.
+#
+# This must run in a post-build script because the ca-certificates
+# bundle (/etc/ssl/certs/ca-certificates.crt) is generated during
+# package finalize hooks, which execute *before* post-build scripts.
+# Rebuild it here the same way CA_CERTIFICATES_GEN_BUNDLE does.
+#
+# Drop this once Debian ships a ca-certificates release (bump
+# CA_CERTIFICATES_VERSION in package/ca-certificates/ca-certificates.mk)
+# that already removed the eMudhra anchors.
+EM_SIGN_ROOTS="emSign_Root_CA_-_G1 emSign_Root_CA_-_C1 emSign_ECC_Root_CA_-_G3 emSign_ECC_Root_CA_-_C3"
+CERTS_DIR="${TARGET_DIR}/etc/ssl/certs"
+for root in ${EM_SIGN_ROOTS}; do
+  rm -f "${TARGET_DIR}/usr/share/ca-certificates/mozilla/${root}.crt"
+done
+
+# Regenerate /etc/ssl/certs: hash-symlink cleanup, per-name links,
+# bundle, and rehash (mirrors CA_CERTIFICATES_GEN_BUNDLE)
+rm -f "${CERTS_DIR}"/*
+: > "${CERTS_DIR}/ca-certificates.crt"
+cd "${TARGET_DIR}" || exit 1
+for i in $(find usr/share/ca-certificates -name '*.crt' | LC_COLLATE=C sort); do
+  ln -sf "../../../${i}" "etc/ssl/certs/$(basename "${i}" .crt).pem"
+  cat "${i}"
+done >> "${CERTS_DIR}/ca-certificates.crt"
+"${HOST_DIR}/bin/c_rehash" "${CERTS_DIR}" > /dev/null
diff --git a/linux/linux.hash b/linux/linux.hash
new file mode 100644
index 0000000..c64498e
--- /dev/null
+++ b/linux/linux.hash
@@ -0,0 +1,17 @@
+# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
+sha256  7a8589912bd7a8adb07fed074283652cf482a35facef8954554654f0154b4af3  linux-6.12.114.tar.xz
+sha256  949d166a1263bd0cf0c5aab44eeb57869615099e7c48bf88d0e4adb77379b999  linux-6.12.104.tar.xz
+sha256  778b058c63da849d0b74006b23509255b2bed57c62a5151e9dd7a62e2cdd70d6  linux-6.6.152.tar.xz
+sha256  362d07fe4938c415ce651aefee063a5c4151109b39c97be039bbaa8312ffc0e2  linux-6.1.183.tar.xz
+# From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
+sha256  09affb2005aea3f44eec3f3eab4c1944e00707355ea7ca7fa2ba6b34a82605ed  linux-5.15.216.tar.xz
+sha256  d10cb9169e49da3d5f7154a01e450012486565fa9442e23d660b0581a3f92645  linux-5.10.265.tar.xz
+sha256  ae6a3207f12aa4d6cfb0fa793ec9da4a6fcdfdcb57d869d63d6b77e3a8c1423d  linux-5.4.302.tar.xz
+# Locally computed
+sha256  93408e0c5d70ff0ab63dcf9edec6fda2b8524281d611a88e56590436bda43914  linux-cip-5.10.246-cip66.tar.gz
+sha256  b3454708b98016f02604433e41060be2c1feb595c2bddeb25292596f047f0915  linux-cip-5.10.246-cip66-rt29.tar.gz
+
+# Licenses hashes
+sha256  fb5a425bd3b3cd6071a3a9aff9909a859e7c1158d54d32e07658398cd67eb6a0  COPYING
+sha256  f6b78c087c3ebdf0f3c13415070dd480a3f35d8fc76f3d02180a407c1c812f79  LICENSES/preferred/GPL-2.0
+sha256  8e378ab93586eb55135d3bc119cce787f7324f48394777d00c34fa3d0be3303f  LICENSES/exceptions/Linux-syscall-note
diff --git a/package/php/php.hash b/package/php/php.hash
new file mode 100644
index 0000000..604e52a
--- /dev/null
+++ b/package/php/php.hash
@@ -0,0 +1,5 @@
+# From https://www.php.net/downloads.php
+sha256  dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd  php-8.3.36.tar.xz
+
+# License file
+sha256  b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a  LICENSE
diff --git a/package/php/php.mk b/package/php/php.mk
new file mode 100644
index 0000000..fd01d75
--- /dev/null
+++ b/package/php/php.mk
@@ -0,0 +1,393 @@
+################################################################################
+#
+# php
+#
+################################################################################
+
+PHP_VERSION = 8.3.36
+PHP_SITE = https://www.php.net/distributions
+PHP_SOURCE = php-$(PHP_VERSION).tar.xz
+PHP_INSTALL_STAGING = YES
+PHP_INSTALL_STAGING_OPTS = INSTALL_ROOT=$(STAGING_DIR) install
+PHP_INSTALL_TARGET_OPTS = INSTALL_ROOT=$(TARGET_DIR) install
+PHP_DEPENDENCIES = host-pkgconf pcre2
+PHP_LICENSE = PHP-3.01
+PHP_LICENSE_FILES = LICENSE
+PHP_CPE_ID_VENDOR = php
+
+# Only affects the Windows operating system
+PHP_IGNORE_CVES += CVE-2024-3566
+
+PHP_CONF_OPTS = \
+	--mandir=/usr/share/man \
+	--infodir=/usr/share/info \
+	--with-config-file-scan-dir=/etc/php.d \
+	--disable-all \
+	--with-external-pcre \
+	--without-pear \
+	--with-config-file-path=/etc \
+	--disable-phpdbg \
+	--disable-rpath
+PHP_CONF_ENV = \
+	EXTRA_LIBS="$(PHP_EXTRA_LIBS)"
+
+ifeq ($(BR2_STATIC_LIBS),y)
+PHP_CONF_ENV += LIBS="$(PHP_STATIC_LIBS)"
+endif
+
+ifeq ($(BR2_STATIC_LIBS)$(BR2_TOOLCHAIN_HAS_THREADS),yy)
+PHP_STATIC_LIBS += -lpthread
+endif
+
+ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
+PHP_EXTRA_LIBS += -latomic
+endif
+
+ifeq ($(BR2_PACKAGE_LIBUCONTEXT),y)
+PHP_DEPENDENCIES += libucontext
+PHP_EXTRA_LIBS += -lucontext
+endif
+
+ifeq ($(call qstrip,$(BR2_TARGET_LOCALTIME)),)
+PHP_LOCALTIME = UTC
+else
+# Not q-stripping this value, as we need quotes in the php.ini file
+PHP_LOCALTIME = $(BR2_TARGET_LOCALTIME)
+endif
+
+# PHP can't be AUTORECONFed the standard way unfortunately
+PHP_DEPENDENCIES += host-autoconf host-automake host-libtool
+define PHP_BUILDCONF
+	cd $(@D) ; $(TARGET_MAKE_ENV) ./buildconf --force
+endef
+PHP_PRE_CONFIGURE_HOOKS += PHP_BUILDCONF
+
+ifeq ($(BR2_ENDIAN),"BIG")
+PHP_CONF_ENV += ac_cv_c_bigendian_php=yes
+else
+PHP_CONF_ENV += ac_cv_c_bigendian_php=no
+endif
+PHP_CONFIG_SCRIPTS = php-config
+
+PHP_CFLAGS = $(TARGET_CFLAGS)
+PHP_CXXFLAGS = $(TARGET_CXXFLAGS)
+
+# The OPcache extension isn't cross-compile friendly
+# Throw some defines here to avoid patching heavily
+ifeq ($(BR2_PACKAGE_PHP_EXT_OPCACHE),y)
+PHP_CONF_OPTS += --enable-opcache --disable-opcache-jit
+PHP_CONF_ENV += ac_cv_func_mprotect=yes
+PHP_CFLAGS += \
+	-DHAVE_SHM_IPC \
+	-DHAVE_SHM_MMAP_ANON \
+	-DHAVE_SHM_MMAP_ZERO \
+	-DHAVE_SHM_MMAP_POSIX \
+	-DHAVE_SHM_MMAP_FILE
+endif
+
+# We need to force dl "detection"
+ifeq ($(BR2_STATIC_LIBS),)
+PHP_CONF_ENV += ac_cv_func_dlopen=yes ac_cv_lib_dl_dlopen=yes
+PHP_EXTRA_LIBS += -ldl
+else
+PHP_CONF_ENV += ac_cv_func_dlopen=no ac_cv_lib_dl_dlopen=no
+endif
+
+# php has some assembly function that is not present in Thumb mode:
+# Error: selected processor does not support `umlal r2,r1,r0,r3' in Thumb mode
+# so, we deactivate Thumb mode
+ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
+PHP_CFLAGS += -marm
+endif
+
+PHP_CONF_OPTS += $(if $(BR2_PACKAGE_PHP_SAPI_CLI),--enable-cli,--disable-cli)
+PHP_CONF_OPTS += $(if $(BR2_PACKAGE_PHP_SAPI_CGI),--enable-cgi,--disable-cgi)
+PHP_CONF_OPTS += $(if $(BR2_PACKAGE_PHP_SAPI_FPM),--enable-fpm,--disable-fpm)
+
+ifeq ($(BR2_PACKAGE_PHP_SAPI_APACHE),y)
+PHP_DEPENDENCIES += apache
+PHP_CONF_OPTS += --with-apxs2=$(STAGING_DIR)/usr/bin/apxs
+
+# Enable thread safety option if Apache MPM is event or worker
+ifeq ($(BR2_PACKAGE_APACHE_MPM_EVENT)$(BR2_PACKAGE_APACHE_MPM_WORKER),y)
+PHP_CONF_OPTS += --enable-zts
+endif
+endif
+
+### Extensions
+PHP_CONF_OPTS += \
+	$(if $(BR2_PACKAGE_PHP_EXT_SOCKETS),--enable-sockets) \
+	$(if $(BR2_PACKAGE_PHP_EXT_POSIX),--enable-posix) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SESSION),--enable-session) \
+	$(if $(BR2_PACKAGE_PHP_EXT_DOM),--enable-dom) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SIMPLEXML),--enable-simplexml) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SOAP),--enable-soap) \
+	$(if $(BR2_PACKAGE_PHP_EXT_XML),--enable-xml) \
+	$(if $(BR2_PACKAGE_PHP_EXT_XMLREADER),--enable-xmlreader) \
+	$(if $(BR2_PACKAGE_PHP_EXT_XMLWRITER),--enable-xmlwriter) \
+	$(if $(BR2_PACKAGE_PHP_EXT_EXIF),--enable-exif) \
+	$(if $(BR2_PACKAGE_PHP_EXT_FTP),--enable-ftp) \
+	$(if $(BR2_PACKAGE_PHP_EXT_TOKENIZER),--enable-tokenizer) \
+	$(if $(BR2_PACKAGE_PHP_EXT_PCNTL),--enable-pcntl) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SHMOP),--enable-shmop) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SYSVMSG),--enable-sysvmsg) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SYSVSEM),--enable-sysvsem) \
+	$(if $(BR2_PACKAGE_PHP_EXT_SYSVSHM),--enable-sysvshm) \
+	$(if $(BR2_PACKAGE_PHP_EXT_ZIP),--with-zip) \
+	$(if $(BR2_PACKAGE_PHP_EXT_CTYPE),--enable-ctype) \
+	$(if $(BR2_PACKAGE_PHP_EXT_FILTER),--enable-filter) \
+	$(if $(BR2_PACKAGE_PHP_EXT_CALENDAR),--enable-calendar) \
+	$(if $(BR2_PACKAGE_PHP_EXT_FILEINFO),--enable-fileinfo) \
+	$(if $(BR2_PACKAGE_PHP_EXT_BCMATH),--enable-bcmath) \
+	$(if $(BR2_PACKAGE_PHP_EXT_PHAR),--enable-phar)
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_LIBARGON2),y)
+PHP_CONF_OPTS += --with-password-argon2=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libargon2
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_LIBSODIUM),y)
+PHP_CONF_OPTS += --with-sodium=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libsodium
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_MBSTRING),y)
+PHP_CONF_OPTS += --enable-mbstring
+PHP_DEPENDENCIES += oniguruma
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_OPENSSL),y)
+PHP_CONF_OPTS += --with-openssl=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += openssl
+# openssl needs zlib, but the configure script forgets to link against
+# it causing detection failures with static linking
+PHP_STATIC_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs openssl`
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_LIBXML2),y)
+PHP_CONF_ENV += php_cv_libxml_build_works=yes
+PHP_CONF_OPTS += --with-libxml
+PHP_DEPENDENCIES += libxml2
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_ZIP),y)
+PHP_DEPENDENCIES += libzip
+endif
+
+ifneq ($(BR2_PACKAGE_PHP_EXT_ZLIB)$(BR2_PACKAGE_PHP_EXT_ZIP),)
+PHP_CONF_OPTS += --with-zlib=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += zlib
+else
+PHP_CONF_OPTS += --disable-mysqlnd_compression_support
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_GETTEXT),y)
+PHP_CONF_OPTS += --with-gettext=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += $(TARGET_NLS_DEPENDENCIES)
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_ICONV),y)
+ifeq ($(BR2_PACKAGE_LIBICONV),y)
+PHP_CONF_OPTS += --with-iconv=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libiconv
+else
+PHP_CONF_OPTS += --with-iconv
+endif
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_INTL),y)
+PHP_CONF_OPTS += --enable-intl
+PHP_DEPENDENCIES += icu
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_GMP),y)
+PHP_CONF_OPTS += --with-gmp=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += gmp
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_READLINE),y)
+PHP_CONF_OPTS += --with-readline=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += readline
+endif
+
+### Native SQL extensions
+ifeq ($(BR2_PACKAGE_PHP_EXT_MYSQLI),y)
+PHP_CONF_OPTS += --with-mysqli
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_PGSQL),y)
+PHP_CONF_OPTS += --with-pgsql=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += postgresql
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_SQLITE),y)
+PHP_CONF_OPTS += --with-sqlite3=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += sqlite
+PHP_STATIC_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs sqlite3`
+endif
+
+### PDO
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO),y)
+PHP_CONF_OPTS += --enable-pdo
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_SQLITE),y)
+PHP_CONF_OPTS += --with-pdo-sqlite=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += sqlite
+PHP_CFLAGS += -DSQLITE_OMIT_LOAD_EXTENSION
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_MYSQL),y)
+PHP_CONF_OPTS += --with-pdo-mysql
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_POSTGRESQL),y)
+PHP_CONF_OPTS += --with-pdo-pgsql=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += postgresql
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_PDO_UNIXODBC),y)
+PHP_CONF_OPTS += --with-pdo-odbc=unixODBC,$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += unixodbc
+endif
+endif
+
+ifneq ($(BR2_PACKAGE_PHP_EXT_MYSQLI)$(BR2_PACKAGE_PHP_EXT_PDO_MYSQL),)
+# Set default MySQL unix socket to what the MySQL server is using by default
+PHP_CONF_OPTS += --with-mysql-sock=$(MYSQL_SOCKET)
+endif
+
+define PHP_DISABLE_VALGRIND
+	$(SED) '/^#define HAVE_VALGRIND/d' $(@D)/main/php_config.h
+endef
+PHP_POST_CONFIGURE_HOOKS += PHP_DISABLE_VALGRIND
+
+ifeq ($(BR2_PACKAGE_PCRE2_JIT),y)
+PHP_CONF_OPTS += --with-pcre-jit=yes
+PHP_CONF_ENV += ac_cv_have_pcre2_jit=yes
+else
+PHP_CONF_OPTS += --with-pcre-jit=no
+PHP_CONF_ENV += ac_cv_have_pcre2_jit=no
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_CURL),y)
+PHP_CONF_OPTS += --with-curl
+PHP_DEPENDENCIES += libcurl
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_XSL),y)
+PHP_CONF_OPTS += --with-xsl=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += libxslt
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_BZIP2),y)
+PHP_CONF_OPTS += --with-bz2=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += bzip2
+endif
+
+### DBA
+ifeq ($(BR2_PACKAGE_PHP_EXT_DBA),y)
+PHP_CONF_OPTS += --enable-dba
+ifneq ($(BR2_PACKAGE_PHP_EXT_DBA_CDB),y)
+PHP_CONF_OPTS += --without-cdb
+endif
+ifneq ($(BR2_PACKAGE_PHP_EXT_DBA_FLAT),y)
+PHP_CONF_OPTS += --without-flatfile
+endif
+ifneq ($(BR2_PACKAGE_PHP_EXT_DBA_INI),y)
+PHP_CONF_OPTS += --without-inifile
+endif
+ifeq ($(BR2_PACKAGE_PHP_EXT_DBA_DB4),y)
+PHP_CONF_OPTS += --with-db4=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += berkeleydb
+endif
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_SNMP),y)
+PHP_CONF_OPTS += --with-snmp=$(STAGING_DIR)/usr
+PHP_DEPENDENCIES += netsnmp
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_GD),y)
+PHP_CONF_OPTS += \
+	--enable-gd \
+	--with-jpeg \
+	--with-freetype
+PHP_DEPENDENCIES += jpeg libpng freetype zlib
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_EXT_FFI),y)
+PHP_CONF_OPTS += --with-ffi
+PHP_DEPENDENCIES += libffi
+endif
+
+ifeq ($(BR2_PACKAGE_PHP_SAPI_FPM),y)
+define PHP_INSTALL_INIT_SYSV
+	$(INSTALL) -D -m 0755 $(@D)/sapi/fpm/init.d.php-fpm \
+		$(TARGET_DIR)/etc/init.d/S49php-fpm
+endef
+
+define PHP_INSTALL_INIT_SYSTEMD
+	$(INSTALL) -D -m 0644 $(@D)/sapi/fpm/php-fpm.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/php-fpm.service
+endef
+
+define PHP_INSTALL_FPM_CONF
+	$(INSTALL) -D -m 0644 package/php/php-fpm.conf \
+		$(TARGET_DIR)/etc/php-fpm.conf
+	rm -f $(TARGET_DIR)/etc/php-fpm.d/www.conf.default
+	# remove unused sample status page /usr/php/php/fpm/status.html
+	rm -rf $(TARGET_DIR)/usr/php
+endef
+
+PHP_POST_INSTALL_TARGET_HOOKS += PHP_INSTALL_FPM_CONF
+endif
+
+define PHP_EXTENSIONS_FIXUP
+	$(SED) "/prefix/ s:/usr:$(STAGING_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/phpize
+	$(SED) "/extension_dir/ s:/usr:$(TARGET_DIR)/usr:" \
+		$(STAGING_DIR)/usr/bin/php-config
+endef
+
+PHP_POST_INSTALL_TARGET_HOOKS += PHP_EXTENSIONS_FIXUP
+
+define PHP_INSTALL_FIXUP
+	rm -rf $(TARGET_DIR)/usr/lib/php/build
+	rm -f $(TARGET_DIR)/usr/bin/phpize
+	$(INSTALL) -D -m 0755 $(PHP_DIR)/php.ini-production \
+		$(TARGET_DIR)/etc/php.ini
+	$(SED) 's%;date.timezone =.*%date.timezone = $(PHP_LOCALTIME)%' \
+		$(TARGET_DIR)/etc/php.ini
+	$(if $(BR2_PACKAGE_PHP_EXT_OPCACHE),
+		$(SED) '/;extension=php_xsl.dll/azend_extension=opcache.so' \
+		$(TARGET_DIR)/etc/php.ini)
+endef
+
+PHP_POST_INSTALL_TARGET_HOOKS += PHP_INSTALL_FIXUP
+
+PHP_CONF_ENV += CFLAGS="$(PHP_CFLAGS)" CXXFLAGS="$(PHP_CXXFLAGS)"
+
+HOST_PHP_CONF_OPTS = \
+	--disable-all \
+	--without-pear \
+	--with-config-file-path=$(HOST_DIR)/etc \
+	--disable-phpdbg \
+	--with-external-pcre \
+	--enable-phar \
+	--enable-json \
+	--enable-filter \
+	--enable-mbstring \
+	--enable-tokenizer \
+	--with-openssl=$(HOST_DIR)
+
+HOST_PHP_DEPENDENCIES = \
+	host-oniguruma \
+	host-openssl \
+	host-pcre2 \
+	host-pkgconf
+
+# PHP can't be AUTORECONFed the standard way unfortunately
+HOST_PHP_DEPENDENCIES += host-autoconf host-automake host-libtool
+define HOST_PHP_BUILDCONF
+	cd $(@D) ; $(HOST_MAKE_ENV) ./buildconf --force
+endef
+HOST_PHP_PRE_CONFIGURE_HOOKS += HOST_PHP_BUILDCONF
+
+$(eval $(autotools-package))
+$(eval $(host-autotools-package))