Red Hat Security Advisory: php security update

The vulnerability CVE-2026-109619 in PHP involves fatal error handling retaining stale request state, leading to a use-after-free condition. This can potentially lead to memory corruption issues. Red Hat has released an update for PHP in Red Hat Enterprise Linux 7 Extended Lifecycle Support to fix this issue. The advisory references Red Hat's errata RHSA-2026:88693 and provides updated packages to remediate the vulnerability.

The use-after-free vulnerability could allow an attacker to cause memory corruption, which may lead to application crashes or potentially arbitrary code execution depending on the context. Red Hat rates the security impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for PHP in Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply the update as described in Red Hat advisory RHSA-2026:88693 and the referenced article https://access.redhat.com/articles/11258. Applying this update remediates the vulnerability. No additional mitigation steps are required beyond applying the official patch.