Low Severity
CVE-2026-109619
Published: Oct 28, 2026
Unofficial fix for CVE-2026-109618 / CVE-2026-109619 (php2shell) for the end-of-life PHP 5.4 / 5.3 packages of RHEL, CentOS and Oracle Linux 7 / 6
# php2shell-eol-backport
Unofficial backport of the official fix for **CVE-2026-109618** and **CVE-2026-109619** ("php2shell") to the
end-of-life PHP packages of **Enterprise Linux 6 and 7**: `php-5.3.3` (RHEL / CentOS / Oracle Linux 6) and
`php-5.4.16` (RHEL / CentOS / Oracle Linux / Scientific Linux 7). Which of the two CVEs affect PHP 5 is
explained in [How serious is this on PHP 5?](#how-serious-is-this-on-php-5)
PHP fixed both vulnerabilities on 21 Oct 2026 in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and published source
backports for 7.4, 8.0 and 8.1. Nothing was released for PHP 5, and the EL6 / EL7 vendors have not shipped
a fix. If you have to keep such a system running, this project gives you rebuilt vendor packages with a
port of the official minimal fix.
> **This is not an official fix from PHP, Red Hat or Oracle.** It reduces the risk until you can move to a
> supported PHP version — do that as soon as you can.
> On EL8 / EL9 / EL10, install your vendor's updates instead (for example ELSA/RHSA-2026:87080, 87151, 87079).
## What is fixed
- [CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and
[CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp), CVSS 4.0 9.2.
- The patch is a port of php-src commit
[712e60f9ed](https://github.com/php/php-src/commit/712e60f9edfd03f0960fc4fc3c2c375f42b90aa2)
("Avoid state corruption via bailout"), the official minimal backport for PHP 7.4, to the PHP 5.3 / 5.4
code base. It is applied on top of the vendor package with all its existing security patches.
- The patches are made against the vendor source trees. They do not apply to the plain `php-5.4.16` /
`php-5.3.3` release tarballs, which lack the vendor's later security fixes in the same code
(for example CVE-2015-4024 in multipart header parsing).
| Distribution | Vendor package | Fixed package from this project |
|---|---|---|
| RHEL / CentOS / Oracle Linux / Scientific Linux 7 | `ph