Cyber ·
oss-sec alert: backported fix for PHP2Shell OOM in PHP 5.4 to 5.6 (CVE-2026-109618)
A message dated 27 October 2026 on the oss-sec list reports a backported fix for the PHP2Shell OOM vulnerability in a custom PHP 5.4.23 and recommends removing or modernizing old PHP versions.
Source: a message posted to the oss-sec list on 27 October 2026, titled as a custom PHP 5.4.23 (covering the 5.4 to 5.6 series) with a backported fix for the PHP2Shell OOM vulnerability, identified as CVE-2026-109618. The available text is an automatic translation and does not detail the fix.
The central point is that the main problem is keeping a very old PHP version installed. The author recommends removing it. If that is not possible, the message suggests two measures: (a) ensure no untrusted user can connect to PHP from server shell access; and (b) consider modernizing the installation.
Relevance for Rota Nacional: the platform does not patch or replace PHP servers, and this alert does not describe any Rota feature. If your organization calls the API from an old system, the risk of keeping that PHP sits in your infrastructure and must be handled there. When using AI to study the alert, do not paste passwords, keys, tokens or logs with personal data into models. The platform detects CPF, CNPJ, e-mail and phone numbers before the model runs, but credentials should stay out of any prompt.
Verification: consult the original message on the oss-sec list for October 2026, using the path shown in the feed, and confirm the version and fix with the vendor or distribution of the PHP you use.