Red Hat Product Security released an important security update for php8.4 on Red Hat Enterprise Linux 10 addressing six vulnerabilities: CVE-2026-7258 (denial of service via improper handling of signed characters in ctype functions), CVE-2026-6735 (cross-site scripting in PHP-FPM due to improper URL sanitation), CVE-2026-7262 (null pointer dereference in SOAP apache:Map decoder), CVE-2026-7568 (signed integer overflow in metaphone()), CVE-2026-7263 (denial of service via DOMNode::C14N()), and CVE-2026-6104 (global buffer over-read in mb_convert_encoding() with attacker-supplied encoding). The advisory includes updated packages for multiple architectures and Red Hat Enterprise Linux variants. No CVSS scores are provided in the advisory, but the update is rated as important.

The vulnerabilities collectively could allow denial of service conditions, cross-site scripting attacks, null pointer dereferences, and memory corruption issues in PHP environments running php8.4 on affected Red Hat Enterprise Linux 10 systems. These issues could impact the stability and security of web applications relying on PHP, potentially leading to service disruption or exploitation of cross-site scripting flaws. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated php8.4 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 should apply the security update as soon as possible by following the instructions in the Red Hat advisory RHSA-2026:22649 (https://access.redhat.com/errata/RHSA-2026:22649). This update includes fixes for all listed CVEs. No additional mitigation steps are indicated beyond applying the official patch.