Cyber ·
CVE-2026-109618 and CVE-2026-109619: unofficial backport for PHP 5.4.16 (EL7) and 5.3.3 (EL6)
A minimal fix for two PHP CVEs, concerning stale state after an out-of-memory bailout, was unofficially backported to PHP packages for Enterprise Linux 6 and 7, without a vendor update. The notice was posted on the oss-sec list on October 22, 2026.
According to the message posted on the oss-sec list on October 22, 2026 by Oleksii Molchanov, the minimal upstream fix for CVE-2026-109618 and CVE-2026-109619 was ported to the PHP 5 packages for Enterprise Linux 6 and 7. The php-src reference commit is 712e60f9ed, titled 'Avoid state corruption via bailout', described as a PHP 7.4 backport. According to the author, package php-5.4.16-48.el7 would become php-5.4.16-48.el7.php2shell.1 for RHEL 7 and derivatives, and php-5.3.3-50.el6_10 is provided for EL6; these packages will not receive a vendor update. The backport is unofficial, meaning it was not produced by the distribution vendor, and the available source text is truncated, so not all technical details can be confirmed here. For administrators of these systems, the practical guidance is to consult the official distribution advisory, verify the origin of any package before installing it, compare hashes and signatures, and assess whether the running version is exposed. Rota Nacional does not patch servers or replace vulnerability management. If the team uses AI to study the text, do not paste credentials, keys, internal host names or logs containing personal data into it. The platform barrier detects CPF, CNPJ, e-mail, phone and names, but does not guarantee removal of technical secrets, so anonymize the material before sending it.