Critical Severity
CVE-2026-109619
Published: Oct 28, 2026
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
# php2shell patches — CVE-2026-109618 / CVE-2026-109619 / CVE-2026-115560 for old PHP (5.4–8.1) & OpenCart / HestiaCP
[](https://github.com/Anton-Barinov/php2shell-patches/actions/workflows/ci.yml)
Emergency backports and hardening for **CVE-2026-109618**, **CVE-2026-109619**, and **CVE-2026-115560**
("php2shell" & session serializer attack chains) — critical unauthenticated RCE vulnerabilities in PHP.
Upstream patched CVE-2026-109618 and CVE-2026-109619 on 21 Oct 2026 (PHP 8.5.12 / 8.4.27 / 8.3.36 /
8.2.35), while the third vector (**CVE-2026-115560**) is slated for the regular release cycle with an
official recommendation to set `session.upload_progress.enabled = 0`.
**PHP 5.4, 5.5, 5.6, 7.x, 8.0, 8.1 are EOL and get no official fix** — this
repo packages complete EOL backports (official + community) plus emergency hardening
for legacy stacks: **OpenCart, WordPress, Drupal, Joomla, Magento**, any
HestiaCP / VestaCP / cPanel host still running old PHP.
> **There is no complete mitigation. Updating to a fixed release (or applying
> a real patch below) is the only safe choice.** Hardening alone only blocks
> known attack paths and buys time.
---
## 🔍 Экспресс-проверка уязвимости сервера (Audit Script)
Вы можете проверить свои серверы на наличие уязвимости и статус наложения патчей в одну строчку:
```bash
curl -fsSL https://raw.githubusercontent.com/Anton-Barinov/php2shell-patches/main/php2shell-check | sudo bash
```
Утилита автоматически просканирует систему (Debian/Ubuntu/CentOS/AlmaLinux/aaPanel/HestiaCP/Plesk), проверит бинарники PHP (CLI, FPM, mod_php), определит наличие бэкпортов и подскажет готовые команды для устранения угрозы.
Для подробных опций (глубокий поиск, безопасная удаленная проверка URL, вывод в JSON для Zabbix/Prometheus):
```bash
chmod +x php2shell-check
./php2shell-check --help
```
---
## Two patch flavors — pick your trade-off
| | **minimal**