https://seclists.org/oss-sec/2026/q4/386: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)
Affected Software
Frequently Asked Questions
Which deployments are directly in scope for this backport?
The backported patch is specifically described for end-of-life PHP 5.4, 5.5, and 5.6 deployments. The affected behavior is associated with file upload progress tracking.
What condition is involved in triggering the issue?
The issue involves out-of-memory conditions during file upload progress tracking, leading to memory exhaustion and crashes. The provided information does not state whether authentication, a particular upload size, or other prerequisites are required.
What can legacy PHP operators do if upstream support is unavailable?
A publicly available backported patch and instructions are referenced for PHP 5.4 through 5.6. The stated purpose is to update the internal memory allocation model to prevent memory exhaustion and crashes.
Is terminating the process on out-of-memory an established mitigation?
The source raises crashing the process on out-of-memory as a question because of the upstream patch size. It does not establish that behavior as a recommended or sufficient mitigation.