CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6)
CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6)
Posted by Oleksii Molchanov on Oct 22 Hi, I have ported the official minimal fix for CVE-2026-109618 and CVE-2026-109619 (php-src commit 712e60f9ed, "Avoid state corruption via bailout", the PHP 7.4 backport) to the PHP 5 packages of Enterprise Linux 6 and 7, which will not get a vendor update: php-5.4.16-48.el7 (RHEL / CentOS / Oracle Linux / Scientific Linux 7) -> php-5.4.16-48.el7.php2shell.1…
Vulnerabilities mentionedAll →
- CVE-2026-1096199.26%PHP has various global state that temporarily points into request memorypublished · php php PoC ×9+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109619 |
Posted by Oleksii Molchanov on Oct 22 Hi, I have ported the official minimal fix for CVE-2026-109618 and CVE-2026-109619 (php-src commit 712e60f9ed, "Avoid state corruption via bailout", the PHP 7.4 backport) to the PHP 5 packages of Enterprise Linux 6 and 7, which will not get a vendor update: php-5.4.16-48.el7 (RHEL / CentOS / Oracle Linux / Scientific Linux 7) -> php-5.4.16-48.el7.php2shell.1 php-5.3.3-50.el6_10 (RHEL / CentOS /...
This source does not provide full text. Read it at seclists.org.
Akamai Blog