Red Hat Security Advisory: php security update

This advisory covers three security fixes for PHP in Red Hat Enterprise Linux 9: CVE-2026-91765 addresses a denial of service vulnerability caused by unbounded recursion in the SOAP parser; CVE-2026-109618 involves an out-of-memory bailout during request parsing that can lead to memory corruption and remote code execution; CVE-2026-109619 is a use-after-free vulnerability due to stale request state retained during fatal error handling. These vulnerabilities affect PHP as embedded in the Apache HTTP Server environment. Red Hat has released updated PHP packages to remediate these issues.

Successful exploitation of these vulnerabilities could result in denial of service, memory corruption, and remote code execution on affected systems running PHP. The use-after-free vulnerability could lead to arbitrary code execution or system instability. These issues pose a significant risk to the confidentiality, integrity, and availability of systems running vulnerable PHP versions.

Red Hat has released updated PHP packages for Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigations are specified by the vendor beyond applying the official update.