https://seclists.org/oss-sec/2026/q4/376: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)
Published Oct 24, 2026
·Updated
Affected Software
1 affected component
PHP PHP=5.4, =5.5, =5.6
Frequently Asked Questions
1
Which PHP deployments are covered by the backported mitigation?
The patch is intended for end-of-life PHP 5.4, 5.5, and 5.6 installations. These versions are no longer supported by the upstream PHP team.
2
What application functionality is associated with the memory-exhaustion issue?
The described failure occurs during file upload progress tracking, where the vulnerability can lead to memory exhaustion and crashes.
3
What is available if an affected legacy PHP version cannot be replaced immediately?
A publicly available backported patch and accompanying instructions are provided for the affected legacy PHP branches.