https://seclists.org/oss-sec/2026/q4/392: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)
Published Oct 26, 2026
·Updated
Affected Software
1 affected component
PHP PHP=5.4, =5.5, =5.6
Frequently Asked Questions
1
Is this an upstream-supported fix for the affected PHP branches?
No. The patch was developed as a backport for legacy PHP 5.4, 5.5, and 5.6 releases, which are described as no longer supported by the upstream PHP team.
2
Does the proposed backport claim to cover more than one CVE?
Yes. The submitter states that the patch mitigates both CVE-2026-109618 and CVE-2026-109619.