Red Hat Security Advisory: php:8.2 security update
This Red Hat security advisory addresses multiple vulnerabilities in the PHP 8. 2 module for Red Hat Enterprise Linux 8. The issues include a hostname null character vulnerability, a NULL pointer dereference in the SOAP extension, a heap-based buffer overflow in array_merge(), information disclosure via getimagesize(), denial of service in PDO PostgreSQL prepared statements, and error checking flaws in the pgsql extension. These vulnerabilities have been rated with an overall security impact of Important by Red Hat. The advisory provides updated packages to remediate these issues. Users of affected Red Hat Enterprise Linux 8 versions are advised to apply the updates as detailed in the vendor advisory. No known exploits in the wild have been reported at this time.
AI Analysis
Technical Summary
Red Hat Product Security released an advisory (RHSA-2026:1412) for PHP 8.2 on Red Hat Enterprise Linux 8 addressing six security vulnerabilities: CVE-2025-1220 (hostname null character vulnerability), CVE-2025-1735 (pgsql extension error checking omission), CVE-2025-6491 (NULL pointer dereference in SOAP extension), CVE-2025-14178 (heap-based buffer overflow in array_merge()), CVE-2025-14177 (information disclosure via getimagesize()), and CVE-2025-14180 (denial of service via invalid character sequence in PDO PostgreSQL prepared statements). The advisory includes updated packages to fix these issues. The vulnerabilities cover a range of weaknesses including CWE-918, CWE-476, CWE-125, and CWE-787. The vendor rates the update as Important and provides detailed instructions for applying the patch. No CVSS scores are provided in the advisory, and no exploits are known in the wild.
Potential Impact
The vulnerabilities collectively could lead to denial of service, information disclosure, memory corruption, and error handling issues in PHP 8.2 environments running on Red Hat Enterprise Linux 8. The impact severity is rated Important by Red Hat, indicating significant security concerns that warrant timely patching. There are no reports of active exploitation in the wild at this time.
Mitigation Recommendations
Red Hat has released updated PHP 8.2 packages for Red Hat Enterprise Linux 8 that address all listed vulnerabilities. Users should apply these official updates promptly following the guidance in Red Hat advisory RHSA-2026:1412 (https://access.redhat.com/articles/11258). Since this is an official fix, applying the vendor-provided patches is the recommended remediation. No additional mitigations are specified or required beyond applying the update.
Red Hat Security Advisory: php:8.2 security update
Description
This Red Hat security advisory addresses multiple vulnerabilities in the PHP 8. 2 module for Red Hat Enterprise Linux 8. The issues include a hostname null character vulnerability, a NULL pointer dereference in the SOAP extension, a heap-based buffer overflow in array_merge(), information disclosure via getimagesize(), denial of service in PDO PostgreSQL prepared statements, and error checking flaws in the pgsql extension. These vulnerabilities have been rated with an overall security impact of Important by Red Hat. The advisory provides updated packages to remediate these issues. Users of affected Red Hat Enterprise Linux 8 versions are advised to apply the updates as detailed in the vendor advisory. No known exploits in the wild have been reported at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Product Security released an advisory (RHSA-2026:1412) for PHP 8.2 on Red Hat Enterprise Linux 8 addressing six security vulnerabilities: CVE-2025-1220 (hostname null character vulnerability), CVE-2025-1735 (pgsql extension error checking omission), CVE-2025-6491 (NULL pointer dereference in SOAP extension), CVE-2025-14178 (heap-based buffer overflow in array_merge()), CVE-2025-14177 (information disclosure via getimagesize()), and CVE-2025-14180 (denial of service via invalid character sequence in PDO PostgreSQL prepared statements). The advisory includes updated packages to fix these issues. The vulnerabilities cover a range of weaknesses including CWE-918, CWE-476, CWE-125, and CWE-787. The vendor rates the update as Important and provides detailed instructions for applying the patch. No CVSS scores are provided in the advisory, and no exploits are known in the wild.
Potential Impact
The vulnerabilities collectively could lead to denial of service, information disclosure, memory corruption, and error handling issues in PHP 8.2 environments running on Red Hat Enterprise Linux 8. The impact severity is rated Important by Red Hat, indicating significant security concerns that warrant timely patching. There are no reports of active exploitation in the wild at this time.
Mitigation Recommendations
Red Hat has released updated PHP 8.2 packages for Red Hat Enterprise Linux 8 that address all listed vulnerabilities. Users should apply these official updates promptly following the guidance in Red Hat advisory RHSA-2026:1412 (https://access.redhat.com/articles/11258). Since this is an official fix, applying the vendor-provided patches is the recommended remediation. No additional mitigations are specified or required beyond applying the update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:1412
- Cve Count
- 6
- Additional Cves
- ["CVE-2025-1735","CVE-2025-6491","CVE-2025-14177","CVE-2025-14178","CVE-2025-14180"]
- Cvss Version
- null
Threat ID: 6a248d78e29bf47b50d6577c
Added to database: 6/6/2026, 9:13:28 PM
Last enriched: 6/6/2026, 9:19:00 PM
Last updated: 6/7/2026, 4:25:59 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.