Unofficial mitigation patches for **CVE-2026-109618 / CVE-2026-109619** ("php2shell")
> ⚠️ This is **not** a vendor fix and **not** a replacement for upgrading. PHP 5.2–5.6
> receive no official security updates. These patches reduce the exploitability of the
> known primitive (OOM → use of corrupted state) but do not make the branch safe.
> The only complete fix is a supported branch: **8.2.35+ / 8.3.36+ / 8.4.27+ / 8.5.12+**.
> Apply only after testing; the authors accept no liability.
| `php-5.2.17-CVE-2026-109618-109619.patch` | 5.2.17 | mod_php (Apache DSO), vanilla tarball | `e709bf51fc51f9e54b1cc4132bc7402254658d6133b34ba1d8b9cf09900bbd9d` |
| `php-5.3.3-CVE-2026-109618-109619.patch` | 5.3.3 | vanilla tarball | `59163bf4630301f332f1a89c14d5c5a0702a0529b6698544b4af4bafa41575e7` |
| `php-5.3.3-50.el6_10-CVE-2026-109618-109619.patch` | 5.3.3-50.el6_10 | CentOS/OL 6.10 distro tree (after the 114 patches from the spec) | `b07a948cfbb57e89e5d1035e170f11b3cd0ac7f65c1c21112d6a804542ad1670` |
| `php-5.4.16-CVE-2026-109618-109619.patch` | 5.4.16 | vanilla tarball | `dd56627b130945d59b4dc37714f2f82c2b8fd58875d0faed9b1f7520a1be3133` |
| `php-5.4.45-CVE-2026-109618-109619.patch` | 5.4.45 | vanilla tarball | `36b8c34e59dc06d42f5be6b2b9a56bdaa6ec4fae7b6331b4b6ec7cf3a92ac9a4` |
| `php-5.5.34-CVE-2026-109618-109619.patch` | 5.5.34 | vanilla tarball | `650c5e045be7a53989339e0370a8f7ea5cad4b69013bd16445025b4767125e4f` |
| `php-5.6.40-CVE-2026-109618-109619.patch` | 5.6.40 | vanilla tarball | `09f568068f0d970b5c3ab89907075edacdcb0ec307d7b4b927e697564ed7cf7a` |
Patches apply to the official `php-.tar.gz` tarballs
(museum.php.net / php.net) with `patch -p1`, no rejects.
- **OOM no longer unwinds the request.** Instead of `zend_error_noreturn()` /
`zend_bailout()` (longjmp), the engine prints a fatal error and calls `_exit(1)`.
The same applies to `safe_address` overflows, string concatenation overflow,
`zend_mm_panic()` and `Balloc()`. Upload temp files are removed before exiting, so
no orphaned `php*` files are left behind.
- **State reset between requests:** `shutdown_executor()` clears error/exception
handlers and `objects_store`; `main.c` clears `PG(http_globals)` and
`modules_activated`; `SAPI.c` clears `SG(request_info)` fields; stacks and llist
- **Multipart parser:** stop reading the body beyond `post_max_size` even without
`Content-Length`; keep only `Content-Disposition`/`Content-Type`; ignore duplicates;
`max_multipart_body_parts` limit that counts every part; `size_t` in `substring_conf`.
- **`session.upload_progress` disabled (5.4+)** — one of the demonstrated exploit
paths; upload progress bars stop working.
Details: [README-CVE-2026-109618-109619.md](README-CVE-2026-109618-109619.md).
Testing methodology and per-branch results: [TESTING.md](TESTING.md).
- 5.2/5.3 patches are unaffected (no `session.upload_progress` there).
Patch context is PHP source, distributed under the
[PHP License 3.01]( Original changes are provided
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
