PHP 5.4 to 5.6: backported fix for the PHP2Shell OOM flaw (CVE-2026-109618)

What happened and what to do

On 26 October 2026, Peter Wolanin posted to the oss-sec list about the backported fix for the PHP2Shell out-of-memory (OOM) vulnerability, identified as CVE-2026-109618, which affects PHP 5.4 to 5.6. According to the message, the Ondrej PPA he uses already had a backported PHP 5.6 fix on the same day. Peter also asks whether anyone compared that fix with other available ones, which shows there is no settled view yet on which backport can be trusted.

For a company still running PHP 5.4 to 5.6, the case calls for an inventory of versions in production, including legacy servers and container images, to find where the exposure exists. Any fix package from a third-party source should then be validated: compare the changed code with the official patch for the CVE, test it in staging, and keep a record of the source and hash of each package applied. Monitoring of security advisories and end-of-life status is also useful to decide between moving to a supported version and applying a controlled fix.

How the consultancy can help

Diagnosis of exposure to PHP 5.4 to 5.6 in the client environment, covering versions, dependencies and package sources. Then a scoped proposal to validate third-party fixes, automate their application in staging and set up monitoring of advisories and unsupported versions.

Next step

If your company still runs PHP 5.4 to 5.6, send a short description of your environment, the versions in use and how packages are installed. Wendelmaques will reply with a scoped proposal for diagnosis, controlled remediation and a migration plan.