Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux)
Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux)
Posted by 賴奇佑 on Oct 22 Hi, For anyone still running PHP on platforms that will not receive a vendor fix for CVE-2026-109618 / CVE-2026-109619 (unauthenticated RCE, CVSS 4.0 9.2), I have published source backports of the upstream minimal mitigation (commit 712e60f9ed, "Avoid state corruption via bailout") for: - PHP 7.3.33 on CentOS/RHEL 7 (Remi php73 7.3.33-22) - PHP 5.4.16 on Amazon Linux 2…
Vulnerabilities mentionedAll →
- CVE-2026-1096199.26%PHP has various global state that temporarily points into request memorypublished · php php PoC ×9+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-109619 |
Posted by 賴奇佑 on Oct 22 Hi, For anyone still running PHP on platforms that will not receive a vendor fix for CVE-2026-109618 / CVE-2026-109619 (unauthenticated RCE, CVSS 4.0 9.2), I have published source backports of the upstream minimal mitigation (commit 712e60f9ed, "Avoid state corruption via bailout") for: - PHP 7.3.33 on CentOS/RHEL 7 (Remi php73 7.3.33-22) - PHP 5.4.16 on Amazon Linux 2 (php-5.4.16-46.amzn2.0.7) - PHP 5.3.29 on Amazon Linux 1...
This source does not provide full text. Read it at seclists.org.
Akamai Blog