The PPA we use https://launchpad.net/~ondrej/+archive/ubuntu/php had a PHP 5.6 back port the same day. Have you compared your patch to other patches?
Peter On Mon, Oct 26, 2026, 13:27 Michael Orlitzky <[email protected]> wrote: > On 2026-10-25 10:33:37, Demi Marie Obenour wrote: > > On 10/24/26 15:56, Roman Kuligin wrote: > > > Hello, I have developed a backported .patch for EOL versions of PHP > (specifically PHP 5.4, 5.5, and 5.6) to mitigate the critical PHP2Shell > Out-of-Memory (OOM) vulnerability (CVE-2026-109618 / CVE-2026-109619). > Since these legacy versions are no longer supported by the upstream PHP > team, this patch updates the internal memory allocation model to prevent > memory exhaustion and crashes during file upload progress tracking. The > patch and instructions are publicly available on GitHub: > https://github.com/akamor2800/php-5.4-cve-2026-php2shell-patch Best > regards. > > > > In light of the size of the upstream patch, would it be better to handle > out of memory by crashing the process instead? > > Considering that PHP 5.x has been out of security support for ~8 years > and out of active support for ~10, best of all would be to crash the > process when it starts. > > For many of those years, there existed no AI marketing departments to > publicize individual vulnerabilities. No one knows how, but hundreds > of vulnerabilities were nevertheless fixed during that time. >
