Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

This Red Hat security advisory announces an update to Red Hat Hardened Images RPMs, specifically PHP packages updated to version 8.5.12-1.hum1 across multiple architectures (aarch64, s390x, x86_64). The advisory addresses two CVEs (CVE-2026-109618 and CVE-2026-109619) involving use-after-free vulnerabilities (CWE-416). The advisory does not specify affected versions or detailed vulnerability descriptions beyond the CWE classification. The update is intended as a bug fix and enhancement for hardened images RPMs. No known exploits in the wild have been reported.

The vulnerabilities involve use-after-free conditions, which can lead to memory corruption and potentially allow attackers to execute arbitrary code or cause denial of service. The advisory classifies the severity as high. However, no active exploitation has been reported, and the update aims to mitigate these security risks by providing patched RPM packages.

Red Hat has released updated RPM packages (version 8.5.12-1.hum1) for multiple PHP components as part of the hardened images update. Users should apply these updates promptly to address the identified vulnerabilities. Detailed update instructions are available at https://images.redhat.com/. No additional mitigation steps are specified in the advisory.