Red Hat Security Advisory: php security update
Multiple security vulnerabilities have been identified and addressed in the PHP packages for Red Hat Enterprise Linux 9. These include a remote code execution vulnerability in the PHP SOAP extension, denial of service via improper handling of signed characters, cross-site scripting in PHP-FPM, memory corruption and information disclosure in PHP SoapServer, null pointer dereferences, and a signed integer overflow. Red Hat has released an important security update to fix these issues.
AI Analysis
Technical Summary
This advisory covers seven distinct vulnerabilities in PHP as packaged for Red Hat Enterprise Linux 9. The most critical is CVE-2026-6722, a use-after-free vulnerability in the PHP SOAP extension that allows remote code execution. Other issues include a denial of service vulnerability due to improper handling of signed characters in ctype functions (CVE-2026-7258), a cross-site scripting vulnerability in PHP-FPM caused by improper URL sanitation (CVE-2026-6735), memory corruption and information disclosure in PHP SoapServer due to incorrect persistence handling (CVE-2026-7261), two null pointer dereference vulnerabilities (CVE-2026-7259 and CVE-2026-7262), and a signed integer overflow in the metaphone() function (CVE-2026-7568). Red Hat has backported fixes from PHP 8.2.31 to PHP 8.0 and released updated packages to address these vulnerabilities.
Potential Impact
Successful exploitation of CVE-2026-6722 could allow remote code execution, posing a critical risk to affected systems. The denial of service vulnerability (CVE-2026-7258) could cause application crashes or service interruptions. The cross-site scripting vulnerability (CVE-2026-6735) could enable attackers to execute malicious scripts in the context of affected web applications. Memory corruption and information disclosure (CVE-2026-7261) could lead to leakage of sensitive information or instability. Null pointer dereference issues (CVE-2026-7259 and CVE-2026-7262) may cause application crashes. The signed integer overflow (CVE-2026-7568) could result in unexpected behavior or security issues. Overall, these vulnerabilities collectively pose a high security risk to systems running affected PHP versions.
Mitigation Recommendations
Red Hat has released updated PHP packages for Red Hat Enterprise Linux 9 that address all listed vulnerabilities. Users should apply these official security updates promptly. Detailed update instructions and package information are available in the Red Hat advisory RHSA-2026:33449 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.
Red Hat Security Advisory: php security update
Description
Multiple security vulnerabilities have been identified and addressed in the PHP packages for Red Hat Enterprise Linux 9. These include a remote code execution vulnerability in the PHP SOAP extension, denial of service via improper handling of signed characters, cross-site scripting in PHP-FPM, memory corruption and information disclosure in PHP SoapServer, null pointer dereferences, and a signed integer overflow. Red Hat has released an important security update to fix these issues.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers seven distinct vulnerabilities in PHP as packaged for Red Hat Enterprise Linux 9. The most critical is CVE-2026-6722, a use-after-free vulnerability in the PHP SOAP extension that allows remote code execution. Other issues include a denial of service vulnerability due to improper handling of signed characters in ctype functions (CVE-2026-7258), a cross-site scripting vulnerability in PHP-FPM caused by improper URL sanitation (CVE-2026-6735), memory corruption and information disclosure in PHP SoapServer due to incorrect persistence handling (CVE-2026-7261), two null pointer dereference vulnerabilities (CVE-2026-7259 and CVE-2026-7262), and a signed integer overflow in the metaphone() function (CVE-2026-7568). Red Hat has backported fixes from PHP 8.2.31 to PHP 8.0 and released updated packages to address these vulnerabilities.
Potential Impact
Successful exploitation of CVE-2026-6722 could allow remote code execution, posing a critical risk to affected systems. The denial of service vulnerability (CVE-2026-7258) could cause application crashes or service interruptions. The cross-site scripting vulnerability (CVE-2026-6735) could enable attackers to execute malicious scripts in the context of affected web applications. Memory corruption and information disclosure (CVE-2026-7261) could lead to leakage of sensitive information or instability. Null pointer dereference issues (CVE-2026-7259 and CVE-2026-7262) may cause application crashes. The signed integer overflow (CVE-2026-7568) could result in unexpected behavior or security issues. Overall, these vulnerabilities collectively pose a high security risk to systems running affected PHP versions.
Mitigation Recommendations
Red Hat has released updated PHP packages for Red Hat Enterprise Linux 9 that address all listed vulnerabilities. Users should apply these official security updates promptly. Detailed update instructions and package information are available in the Red Hat advisory RHSA-2026:33449 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:33449
- Cve Count
- 7
- Additional Cves
- ["CVE-2026-6735","CVE-2026-7258","CVE-2026-7259","CVE-2026-7261","CVE-2026-7262","CVE-2026-7568"]
- Cvss Version
- null
Threat ID: 6a4452eb27e9c797198e3add
Added to database: 06/30/2026, 23:36:11 UTC
Last enriched: 06/30/2026, 23:53:44 UTC
Last updated: 07/01/2026, 00:11:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.