php-5.4-cve-2026-php2shell-patch

Patch for old php 5.4.23 version from CVE-2026-109618 и CVE-2026-109619 vulnerabilities (OOM Vulnerability Mitigation)

This repository contains a custom .patch file for *PHP 5.4.23 to fix the critical PHP2Shell Out-of-Memory (OOM) vulnerability (CVE-2026-109618 / CVE-2026-109619).

Since PHP 5.4.23 is officially End-of-Life (EOL), this patch modifies the memory allocation model in the core handling routines to prevent memory exhaustion vectors during file upload progress tracking.

How to use / Как применить патч

1. Download the PHP 5.4.23 source code and extract it:

   tar -xvf php-5.4.23.tar.gz
   cd php-5.4.23
   

2. Download this patch file into the PHP source directory.

3. Apply the patch:

   patch -p1 < php-5.4.23-oom-startup-failclosed.patch
   patch -p1 < php-5.4.23-session-state.patch
   or
   patch -p1 < php-5.4.23-php2shell-combined.patch
   or
   (find yourself this kind of lines in 5.4 - 5.6 all versions and make your own patch careffuly)
   

4. Recompile your PHP as usual:

   ./configure --your-modules-flags...
   make clean
   make
   sudo make install
   

Verification / Проверка

After compiling, you can verify that the memory management limits work properly under high-concurrency upload payloads without causing a segmentation fault or OOM crash.

Disclaimer

Provided as-is. Test thoroughly in a staging environment before upgrading production servers.