https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:52:08.821118+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:56969 ALSA-2026:56969 — Important: php8.4 security, bug fix, and enhancement update 2026-10-02T19:52:08.963172+00:00

Affected: AlmaLinux:10: php8.4, AlmaLinux:10: php8.4-bcmath, AlmaLinux:10: php8.4-cli, AlmaLinux:10: php8.4-common, AlmaLinux:10: php8.4-dba, AlmaLinux:10: php8.4-dbg, AlmaLinux:10: php8.4-devel, AlmaLinux:10: php8.4-embedded, AlmaLinux:10: php8.4-enchant, AlmaLinux:10: php8.4-ffi and 15 more

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bell-cve-2026-17544 Withdrawn: BELL-CVE-2026-17544 — CVE-2026-17544 does not affect BellSoft software 2026-10-02T19:52:08.963310+00:00

Withdrawn by the publisher.

https://cve.radiocsirt.org/vuln/bit-libphp-2026-17544 BIT-libphp-2026-17544 — Out-of-bounds write in bccomp() via crafted operand and scale 2026-10-02T19:52:08.963330+00:00

Affected: Bitnami: libphp

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0952 certfr-2026-avi-0952 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque… 2026-10-02T19:52:08.963351+00:00 certfr-2026-avi-0952 https://cve.radiocsirt.org/vuln/euvd-2026-343156 EUVD-2026-343156 2026-10-02T19:52:08.963367+00:00 EUVD-2026-343156 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17544 fkie_cve-2026-17544 2026-10-02T19:52:08.963378+00:00

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0375 NCSC-2026-0375 — Kwetsbaarheden verholpen in Oracle Communications 2026-10-02T19:52:08.963398+00:00 NCSC-2026-0375 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11418-1 openSUSE-SU-2026:11418-1 — php8-8.5.9-1.1 on GA media 2026-10-02T19:52:08.963452+00:00

php8-8.5.9-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:47200 RHSA-2026:47200 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T19:52:08.963495+00:00

php: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability php: PHP: Denial of Service via circular symbolic links in phar archives php: ext-pgsql: PHP: SQL injection via improper backslash escaping php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()

 https://cve.radiocsirt.org/vuln/rlsa-2026:56969 RLSA-2026:56969 — Important: php8.4 security, bug fix, and enhancement update 2026-10-02T19:52:08.963532+00:00

Affected: Rocky Linux:10: php8.4

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)

* php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:Rocky Linux-223949)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:23121-1 SUSE-SU-2026:23121-1 — Security update for php8 2026-10-02T19:52:08.963559+00:00

Security update for php8

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-17544 UBUNTU-CVE-2026-17544 2026-10-02T19:52:08.963576+00:00

Affected: Ubuntu:26.04:LTS: php8.5

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2598 WID-SEC-W-2026-2598 — PHP: Mehrere Schwachstellen 2026-10-02T19:52:08.963593+00:00

Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um SQL-Injection durchzuführen, beliebigen Code auszuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.