https://seclists.org/oss-sec/2026/q4/329: CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6)
Published Oct 22, 2026
·Updated
Affected Software
1 affected component
PHP PHP=5.4.16, =5.3.3
Frequently Asked Questions
1
Which Enterprise Linux package builds have unofficial patched replacements available?
For EL7, php-5.4.16-48.el7 is replaced by php-5.4.16-48.el7.php2shell.1. For EL6, php-5.3.3-50.el6_10 is replaced by php-5.3.3-50.el6_10.php2shell.1.
2
Should affected EL6 or EL7 systems expect a vendor update?
No. The referenced EL6 and EL7 PHP 5 packages are stated to not receive a vendor update, and the replacements are unofficial backports.
3
What happens when the patched PHP 5 engine encounters an allocation failure or relevant allocation-size overflow check?
The port changes these paths so they print an error to stderr and call _exit(1), rather than bailing out. This behavior was ported directly to PHP 5.4.16 and 5.3.3.
4
Were these patches prepared against the stock vendor source trees?
Yes. They were made against the vendor source trees after %prep, with all vendor patches applied. The associated project also contains spec-file changes, a container build, and CI.