Cyber ·
PHP 5.4-5.6: backported fix for the PHP2Shell OOM flaw (CVE-2026-109618)
A message posted to the oss-sec feed on October 26 reports that a backported fix for PHP 5.6 was available the same day from a package repository, and asks whether the fix was compared with others.
This item is a security notice relayed through the oss-sec discussion feed. The title indicates a backported fix, meaning one applied to older PHP versions, for the out-of-memory (OOM) vulnerability known as PHP2Shell, recorded as CVE-2026-109618. The title cites PHP 5.4.23 with custom builds for the 5.4 to 5.6 series. The content is an automatic translation of a message published on October 26. According to the message, a package repository used by the author already had a backported fix for PHP 5.6 that same day. The author also asks whether anyone compared that fix with others available. The message does not describe the technical mechanism of the flaw, the full list of affected versions, or any equivalence analysis between fixes. For those details, consult the original message and the official PHP project notes.