Red Hat Security Advisory: php security, bug fix, and enhancement update

This Red Hat security advisory addresses three PHP vulnerabilities: CVE-2026-14355 is a memory corruption flaw in the OpenSSL extension's openssl_encrypt function when using AES-WRAP-PAD; CVE-2026-17543 is an SQL injection vulnerability in the ext-pgsql extension caused by improper backslash escaping; CVE-2026-7260 is a denial of service vulnerability triggered by circular symbolic links in phar archives. Red Hat has backported fixes for these vulnerabilities to PHP 8.0 in the 9.8.z update stream and to PHP 7.4 in the 8.10.z update stream for Red Hat Enterprise Linux 9 and 8 respectively. The advisory includes detailed package updates and references to vendor documentation for applying the patches.

Successful exploitation of CVE-2026-14355 could lead to memory corruption in PHP's OpenSSL extension, potentially causing crashes or other unintended behavior. CVE-2026-17543 allows SQL injection via improper escaping in PostgreSQL queries, which could lead to unauthorized database access or manipulation. CVE-2026-7260 enables denial of service through processing of crafted phar archives with circular symbolic links, potentially causing application crashes or resource exhaustion. The overall severity is rated low for PHP 8.0 updates and important for PHP 7.4 updates by Red Hat.

Red Hat has released updated PHP packages for Red Hat Enterprise Linux 8 and 9 that include backported fixes for these vulnerabilities. Users should apply the updates as described in Red Hat advisory RHSA-2026:61259 for RHEL 9 and RHSA-2026:62334 for RHEL 8. The vendor provides detailed instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying these official patches.