Red Hat Security Advisory: php security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: heap-based buffer overflow in array_merge() (CVE-2025-14178) * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This advisory reports multiple security vulnerabilities in PHP related to memory safety issues, specifically out-of-bounds read and write conditions (CWE-125 and CWE-787). These types of vulnerabilities can potentially lead to memory corruption, crashes, or other unintended behavior in applications using affected PHP versions. The advisory references Red Hat Product Security's RHSA-2026:2799 but does not provide explicit patch or remediation details. No CVSS score is assigned, and no affected versions are specified in the data provided.
Potential Impact
The vulnerabilities involve out-of-bounds memory access which may allow attackers to cause application crashes or potentially execute arbitrary code depending on exploitation conditions. However, no known exploits have been reported in the wild, and the exact impact depends on the PHP version and deployment context.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory RHSA-2026:2799 and official PHP security announcements for current remediation guidance. Until patches are available, monitor vendor communications for updates. No specific mitigations are provided in the current advisory.
Red Hat Security Advisory: php security update
Description
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: heap-based buffer overflow in array_merge() (CVE-2025-14178) * php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory reports multiple security vulnerabilities in PHP related to memory safety issues, specifically out-of-bounds read and write conditions (CWE-125 and CWE-787). These types of vulnerabilities can potentially lead to memory corruption, crashes, or other unintended behavior in applications using affected PHP versions. The advisory references Red Hat Product Security's RHSA-2026:2799 but does not provide explicit patch or remediation details. No CVSS score is assigned, and no affected versions are specified in the data provided.
Potential Impact
The vulnerabilities involve out-of-bounds memory access which may allow attackers to cause application crashes or potentially execute arbitrary code depending on exploitation conditions. However, no known exploits have been reported in the wild, and the exact impact depends on the PHP version and deployment context.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory RHSA-2026:2799 and official PHP security announcements for current remediation guidance. Until patches are available, monitor vendor communications for updates. No specific mitigations are provided in the current advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:2799
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-14178"]
Threat ID: 6a248d78e29bf47b50d6530b
Added to database: 06/06/2026, 21:13:28 UTC
Last enriched: 07/02/2026, 23:38:50 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.