Critical Severity
CVE-2026-109619
Published: Oct 25, 2026
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
# php2shell patches — CVE-2026-109618 / CVE-2026-109619 for old PHP (5.4–8.1) & OpenCart / HestiaCP
[](https://github.com/Anton-Barinov/php2shell-patches/actions/workflows/ci.yml)
Emergency backports and hardening for **CVE-2026-109618** and **CVE-2026-109619**
("php2shell") — two critical unauthenticated RCE vulnerabilities in PHP,
CVSS v4.0 **9.2**. Fixed upstream 21 Oct 2026 (PHP 8.5.12 / 8.4.27 / 8.3.36 /
8.2.35). **PHP 5.4, 5.5, 5.6, 7.x, 8.0, 8.1 are EOL and get no official fix** — this
repo packages EOL backports (official + community) plus emergency hardening
for legacy stacks: **OpenCart, WordPress, Drupal, Joomla, Magento**, any
HestiaCP / VestaCP / cPanel host still running old PHP.
> **There is no complete mitigation. Updating to a fixed release (or applying
> a real patch below) is the only safe choice.** Hardening alone only blocks
> known attack paths and buys time.
---
## Two patch flavors — pick your trade-off
| | **minimal** (official PHP-group) | **enhanced-universal** (community) |
|---|---|---|
| Fixes CVE-2026-109618 (OOM → RCE) | ✅ | ✅ |
| Fixes CVE-2026-109619 (upload_progress UAF) | ✅ by **disabling** upload_progress | ✅ by **fixing the root cause** (counters as `zend_long`, no dangling `zval*`) |
| `multipart/form-data` file uploads | ✅ work | ✅ work |
| Session upload **progress bar** | ❌ disabled | ✅ **still works** |
| Blocks session-fixation via POST body | ❌ | ✅ (PR #22113) |
| Sanitizes filename in session file (LFI / handler-mismatch) | ❌ | ✅ |
| Resets `PS(serializer)` between FPM requests | ❌ | ✅ |
| Officially blessed by PHP Group | ✅ (7.4/8.0/8.1 branches) | ❌ (community, but combines official OOM fix + root-cause UAF fix) |
**Rule of thumb:**
- Want the safest, most conservative fix and don't care about upload
progress bars → **minimal**.
- Need working forms / progress bars (e.g. OpenCart admin product forms,
large file upload