Unofficial patch targets PHP2Shell OOM in PHP 5.4–5.6
Original title: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)
The community backport covers unsupported PHP 5.4, 5.5, and 5.6 for CVE-2026-109618 and CVE-2026-109619.
Roman Kuligin posted a backported patch for end-of-life PHP 5.4, 5.5, and 5.6, including a custom PHP 5.4.23 line, addressing the PHP2Shell out-of-memory vulnerability tracked as CVE-2026-109618 and CVE-2026-109619. He says upstream no longer supports these versions and that the patch changes memory allocation to prevent exhaustion and crashes during file-upload progress tracking. The announcement describes the issue as critical, but the feed snippet does not include the patch itself.
Unconfirmed: The patch is an unofficial backport, not an upstream PHP release.
- The post was made on October 24.
- It specifically names PHP 5.4, 5.5, and 5.6.
- The stated trigger is file-upload progress tracking.
- Upstream PHP does not support these legacy versions.
Impact: Memory exhaustion and crashes during file uploads
| Product | Affected |
|---|---|
| PHP | 5.4, 5.5, and 5.6 |
- 1.Review the unofficial backport before applying it to EOL PHP.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
Posted by Roman Kuligin on Oct 24 Hello, I have developed a backported . patch for EOL versions of PHP (specifically PHP 5. 4, 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.