On 10/24/26 15:56, Roman Kuligin wrote: > Hello, I have developed a backported .patch for EOL versions of PHP > (specifically PHP 5.4, 5.5, and 5.6) to mitigate the critical PHP2Shell > Out-of-Memory (OOM) vulnerability (CVE-2026-109618 / CVE-2026-109619). Since > these legacy versions are no longer supported by the upstream PHP team, this > patch updates the internal memory allocation model to prevent memory > exhaustion and crashes during file upload progress tracking. The patch and > instructions are publicly available on GitHub: > https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch Best regards.
In light of the size of the upstream patch, would it be better to handle out of memory by crashing the process instead? -- Sincerely, Demi Marie Obenour (she/her/hers)
OpenPGP_signature.asc
Description: OpenPGP digital signature
