Red Hat Security Advisory: php security update
Multiple security vulnerabilities have been identified in PHP as packaged for Red Hat Enterprise Linux 10, including denial of service, cross-site scripting, null pointer dereferences, and signed integer overflow issues. These vulnerabilities affect PHP core functions and PHP-FPM, potentially impacting systems running affected versions. Red Hat has issued an important security advisory with updates addressing these issues.
AI Analysis
Technical Summary
This Red Hat security advisory covers multiple vulnerabilities in PHP 8.0.30-6.el9_8 on Red Hat Enterprise Linux 9. The vulnerabilities include CVE-2026-6722, a use-after-free in the PHP SOAP extension leading to remote code execution; CVE-2026-7258, a denial of service caused by improper handling of signed characters in ctype functions; CVE-2026-6735, a cross-site scripting vulnerability in PHP-FPM due to improper URL sanitation; CVE-2026-7261, memory corruption and information disclosure in PHP SoapServer; CVE-2026-7259 and CVE-2026-7262, null pointer dereferences in php_mb_check_encoding() and SOAP apache:Map decoder respectively; and CVE-2026-7568, a signed integer overflow in metaphone(). These vulnerabilities have been backported from PHP 8.2.31 to PHP 8.0 in Red Hat Enterprise Linux 9. The advisory references fixes in the updated PHP packages for multiple architectures and variants of Red Hat Enterprise Linux 9.
Potential Impact
The vulnerabilities collectively allow for remote code execution, denial of service, cross-site scripting, memory corruption, information disclosure, and application crashes due to null pointer dereferences or integer overflows. The remote code execution vulnerability (CVE-2026-6722) is particularly severe as it allows an unauthenticated attacker to execute arbitrary code via the PHP SOAP extension. The denial of service and cross-site scripting vulnerabilities can disrupt service availability and compromise client security respectively. Memory corruption and information disclosure may expose sensitive data or destabilize the PHP runtime. Null pointer dereferences and integer overflows can cause application crashes or unpredictable behavior.
Mitigation Recommendations
An official security update from Red Hat is available addressing all listed vulnerabilities in PHP 8.0.30-6.el9_8 and related packages for Red Hat Enterprise Linux 9 on supported architectures. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified or required beyond applying the official patch. The update is rated as Important by Red Hat Product Security.
Red Hat Security Advisory: php security update
Description
Multiple security vulnerabilities have been identified in PHP as packaged for Red Hat Enterprise Linux 10, including denial of service, cross-site scripting, null pointer dereferences, and signed integer overflow issues. These vulnerabilities affect PHP core functions and PHP-FPM, potentially impacting systems running affected versions. Red Hat has issued an important security advisory with updates addressing these issues.
CVSS v4.0
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory covers multiple vulnerabilities in PHP 8.0.30-6.el9_8 on Red Hat Enterprise Linux 9. The vulnerabilities include CVE-2026-6722, a use-after-free in the PHP SOAP extension leading to remote code execution; CVE-2026-7258, a denial of service caused by improper handling of signed characters in ctype functions; CVE-2026-6735, a cross-site scripting vulnerability in PHP-FPM due to improper URL sanitation; CVE-2026-7261, memory corruption and information disclosure in PHP SoapServer; CVE-2026-7259 and CVE-2026-7262, null pointer dereferences in php_mb_check_encoding() and SOAP apache:Map decoder respectively; and CVE-2026-7568, a signed integer overflow in metaphone(). These vulnerabilities have been backported from PHP 8.2.31 to PHP 8.0 in Red Hat Enterprise Linux 9. The advisory references fixes in the updated PHP packages for multiple architectures and variants of Red Hat Enterprise Linux 9.
Potential Impact
The vulnerabilities collectively allow for remote code execution, denial of service, cross-site scripting, memory corruption, information disclosure, and application crashes due to null pointer dereferences or integer overflows. The remote code execution vulnerability (CVE-2026-6722) is particularly severe as it allows an unauthenticated attacker to execute arbitrary code via the PHP SOAP extension. The denial of service and cross-site scripting vulnerabilities can disrupt service availability and compromise client security respectively. Memory corruption and information disclosure may expose sensitive data or destabilize the PHP runtime. Null pointer dereferences and integer overflows can cause application crashes or unpredictable behavior.
Mitigation Recommendations
An official security update from Red Hat is available addressing all listed vulnerabilities in PHP 8.0.30-6.el9_8 and related packages for Red Hat Enterprise Linux 9 on supported architectures. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified or required beyond applying the official patch. The update is rated as Important by Red Hat Product Security.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:33449
- Cve Count
- 7
- Additional Cves
- ["CVE-2026-6735","CVE-2026-7258","CVE-2026-7259","CVE-2026-7261","CVE-2026-7262","CVE-2026-7568"]
- Cvss Version
- null
Threat ID: 6a4452eb27e9c797198e3add
Added to database: 06/30/2026, 23:36:11 UTC
Last enriched: 07/22/2026, 01:45:27 UTC
Last updated: 08/12/2026, 21:24:43 UTC
Views: 110
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.