Cyber ·
oss-sec discussion on a backported patch for the PHP2Shell OOM flaw in PHP 5.4.23
Oct 26 discussion on the oss-sec mailing list about a backported patch for the PHP2Shell OOM vulnerability in PHP 5.4.23, a line out of security support for about eight years.
According to the available material, published on the oss-sec list by Michael Orlitzky on October 26, 2026, the discussion covers a backported patch for the PHP2Shell OOM vulnerability in PHP 5.4.23. The comment states that the PHP 5.x line has been out of security support for about eight years and out of active support for about ten years. The author criticizes the disclosure of individual vulnerabilities, suggests that the best outcome would be ending the process when it starts, and notes that in earlier years hundreds of vulnerabilities were fixed without this kind of disclosure. The text is a machine translation of the feed and does not describe technical details of the flaw, the fix, or impact on specific systems. To verify the facts, consult the original message on the oss-sec list, in the October 2026 archive, and the official PHP project advisories. For anyone running PHP, the practical point is to inventory the versions in use and plan a move to a version that still receives security fixes. Rota Nacional does not patch PHP applications and does not replace software updates.