Security fixes for PHP 5.6 after its end of life: PHP2Shell and CVE-2019-11043

PHP 5.6 has had no security fixes from PHP since 2018, and PHP did not publish one for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on it. Nextweb ported the fix to PHP 5.6.40, together with the php-fpm fix for CVE-2019-11043, and publishes the result as a package. This page says why 5.6 got no fix, what the port changes and what it leaves alone, how it was tested, and how to install it, from a run on 25 October 2026. It is for an application that cannot leave PHP 5.6 yet; moving it to PHP 8 is still the answer.

Why PHP 5.6 got no fix

PHP's end-of-life page, read on 25 October 2026, gives 5.6's end of life as 31 December 2018 and its last release as 5.6.40, which the PHP 5 ChangeLog dates 10 January 2019.

When PHP disclosed PHP2Shell on 21 October 2026, its announcement said that PHP 8.1 and older "no longer receive updates from the PHP project", and that its security team "provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor". Nothing went back to 5.6. Both advisories, GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, are rated Critical and list only the supported branches as affected; 5.6's code has the same two weaknesses, which is why the port below follows the fix change by change.

CVE-2019-11043 is older: an underflow in php-fpm's handling of PATH_INFO. PHP fixed it in the PHP 7 branches with the commit "Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)"; the PHP 7 ChangeLog lists the fix in 7.1.33, dated 24 October 2019, and again in 7.4.0. By then 5.6 had been out of support for ten months.

What the package carries

php5.6.40-linux-x64 is PHP's own 5.6.40 tarball, checked against its SHA-256 and its release signature when it was pinned, with two patches, each pinned by its own SHA-256:

• PHP2Shell. A port of PHP's commit "Avoid state corruption via bailout" (712e60f9), the minimal backport PHP made for 7.4, to the Zend Engine 2 that PHP 5.6 runs on.
• CVE-2019-11043. The fpm_main.c change of the commit above.

The port does what 712e60f9 does, in 5.6's code:

• An allocation failure, reaching memory_limit among them, prints the fatal error and ends the process. It no longer jumps back into a request whose memory is half set up.
• After a request is cut short, the state it leaves behind is reset before its memory is freed: the user error and exception handlers, the object store, the request's input arrays, and the fields the server API frees.
• Multipart parsing keeps only the Content-Disposition and Content-Type headers of each part, ignores duplicates, and counts parts against a new INI setting, max_multipart_body_parts. Its default, -1, means max_input_vars plus max_file_uploads.
• Session upload progress is off, in the code and in the package's php.ini.

One part of 712e60f9 is not ported: the change to how the request's input arrays are created. 5.6's hash tables are built differently from 7.4's, and they already allocate nothing until the first insert, so php_variables.c keeps its own code. The package carries a docs/README.md that lists every place the port differs from 712e60f9.

What changes for your application

• Reaching memory_limit, or any other allocation failure, ends the PHP process at once. The fatal error goes to standard error, functions registered with register_shutdown_function() do not run, and buffered output is not sent. Under php-cgi or php-fpm the worker is replaced.
• $_SESSION never gets upload progress entries.
• A multipart request with more parts than max_multipart_body_parts stops being parsed at the limit, with a warning.

What it does not fix

This package fixes those three CVEs and nothing else. Every other vulnerability found in PHP 5.6 after 5.6.40 is still in it.

The libraries it bundles come from CentOS 7, where it is built: OpenSSL 1.0.2k, curl, libxml2 and the rest. The CentOS Project says "CentOS Linux 7 end of life is June 30, 2024", and OpenSSL says "OpenSSL 1.0.2 is out of support since 1st January 2020 and is no longer receiving updates". Both were read on 25 October 2026.

How it was tested

PHP's own 5.6.40 test suite, 2,400 tests from Zend/tests, tests/basic, tests/lang, ext/session/tests and ext/standard/tests/general_functions, was run before and after patching. Nine tests fail only with the patches, and the change explains each: eight ext/session/tests/rfc1867*.phpt tests expect upload progress, which is off, and tests/lang/bug45392.phpt expects the memory-limit fatal error through the normal error handler, where it now arrives on standard error.

The memory-limit exit was also checked on its own. Unpatched, PHP prints the fatal error, runs its shutdown function and exits with 255. Patched, it prints the error to standard error, runs no shutdown function and exits with 1.

The package was installed and checked by Nextweb's verification on AlmaLinux 9, Debian 12 and Ubuntu 24.04 on 23 October 2026. No attack was run against it: what it fixes rests on the port following PHP's fix, and on the tests above.

Install it

The run below used Nextweb 1.0.0-beta.1.rc.8 (build 175) on Ubuntu 24.04.

nextweb:/> pkg install php5.6.40-linux-x64

Installation order: php5.6.40-linux-x64
Installing 1 package(s)...

Installing php5.6.40-linux-x64...
...
php5.6.40-linux-x64 5.6.40 installed successfully

It installs into nextweb_server/runtime/php5.6.40-linux-x64. The programs there find the libraries they bundle through LD_LIBRARY_PATH, which Nextweb sets for the processes it starts; from a shell, set it yourself:

$ cd nextweb_server/runtime/php5.6.40-linux-x64
$ LD_LIBRARY_PATH=lib/nextweb-deps bin/php -c etc/php.ini -v

PHP 5.6.40 (cli) (built: Oct 23 2026 23:31:00)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies

The same binary, asked for its OpenSSL and the two settings the port touches:

$ LD_LIBRARY_PATH=lib/nextweb-deps bin/php -c etc/php.ini -r 'echo OPENSSL_VERSION_TEXT, "\n"; var_dump(ini_get("session.upload_progress.enabled"), ini_get("max_multipart_body_parts"));'

OpenSSL 1.0.2k-fips  26 Jan 2017
string(1) "0"
string(2) "-1"

Upload progress is off, and max_multipart_body_parts is at its default, -1: with this php.ini's max_input_vars of 1000 and max_file_uploads of 20, a request is parsed up to 1,020 parts.

The package provides php5.6-runtime and never php-runtime, so nothing installs it unless you ask for it by name. Nextweb deploys WordPress and Node.js applications; it does not deploy a PHP 5.6 application for you yet. The runtime's bin/php-cgi and sbin/php-fpm are there to run behind the web server you use today.

Move to PHP 8

This package buys time; it does not make PHP 5.6 a supported runtime. PHP 8.3.36 and 8.5.12 fix PHP2Shell and are supported by PHP, and How to patch WordPress for PHP2Shell shows a site moving to 8.3.36 on Nextweb.

Questions

Is PHP 5.6 affected by PHP2Shell?

PHP's advisories list only the branches it supports, but PHP 5.6 has the same two weaknesses in its code, and PHP published no fix for it.

Does this package make PHP 5.6 safe?

No. It fixes PHP2Shell and CVE-2019-11043 and nothing else, and the libraries it bundles no longer get updates. It keeps an application running while it moves to PHP 8.

Can Nextweb run a PHP 5.6 application for me?

Not yet. The package installs the runtime, and its php-cgi and php-fpm run behind the web server you use. Nextweb deploys WordPress and Node.js applications.