This Red Hat security advisory for php8.4 addresses six vulnerabilities: a denial of service via improper handling of signed characters in ctype functions (CVE-2026-7258), a cross-site scripting vulnerability in PHP-FPM due to improper URL sanitation (CVE-2026-6735), a NULL pointer dereference in the SOAP apache:Map decoder (CVE-2026-7262), a signed integer overflow in metaphone() (CVE-2026-7568), a denial of service via DOMNode::C14N() (CVE-2026-7263), and a global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104). The advisory applies to php8.4 packages on Red Hat Enterprise Linux 10 across multiple architectures. Red Hat has released updated packages to fix these vulnerabilities.

The vulnerabilities include denial of service conditions, cross-site scripting, NULL pointer dereference, integer overflow, and buffer over-read, which could lead to application crashes, potential code execution, or information disclosure depending on the context of use. The advisory rates the overall impact as important, indicating significant security concerns that could affect PHP-based web applications running on affected Red Hat Enterprise Linux 10 systems.

Red Hat has released updated php8.4 packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the official security update as described in the Red Hat advisory RHSA-2026:22649 to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.