Red Hat Security Advisory: php:8.2 security update

This advisory covers three security vulnerabilities in PHP 8.2 as packaged by Red Hat for Red Hat Enterprise Linux 8. CVE-2026-91765 is a denial of service vulnerability caused by unbounded recursion in the SOAP parser. CVE-2026-109618 involves an out-of-memory bailout during request parsing that can cause memory corruption and potentially remote code execution. CVE-2026-109619 is a use-after-free vulnerability resulting from stale request state retained during fatal error handling. Red Hat has released updated PHP 8.2 packages to address these issues.

Successful exploitation of these vulnerabilities could result in denial of service (CVE-2026-91765), memory corruption and remote code execution (CVE-2026-109618), and use-after-free leading to potential arbitrary code execution or application instability (CVE-2026-109619). These impacts affect systems running vulnerable PHP 8.2 versions on Red Hat Enterprise Linux 8. The severity is rated as important by Red Hat.

Red Hat has released an official security update for PHP 8.2 on Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate these issues. No additional mitigation steps are indicated beyond applying the official patch.