https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:08:31.006264+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:56969 ALSA-2026:56969 — Important: php8.4 security, bug fix, and enhancement update 2026-10-02T16:08:31.058609+00:00

Affected: AlmaLinux:10: php8.4, AlmaLinux:10: php8.4-bcmath, AlmaLinux:10: php8.4-cli, AlmaLinux:10: php8.4-common, AlmaLinux:10: php8.4-dba, AlmaLinux:10: php8.4-dbg, AlmaLinux:10: php8.4-devel, AlmaLinux:10: php8.4-embedded, AlmaLinux:10: php8.4-enchant, AlmaLinux:10: php8.4-ffi and 15 more

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bell-cve-2026-7260 BELL-CVE-2026-7260 2026-10-02T16:08:31.058748+00:00

Affected: Alpaquita:25: php83, Alpaquita:stream: php83

 https://cve.radiocsirt.org/vuln/bit-libphp-2026-7260 BIT-libphp-2026-7260 — Stack overflow in phar with circular symlinks 2026-10-02T16:08:31.058777+00:00

Affected: Bitnami: libphp

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0952 certfr-2026-avi-0952 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque… 2026-10-02T16:08:31.058802+00:00 certfr-2026-avi-0952 https://cve.radiocsirt.org/vuln/euvd-2026-342579 EUVD-2026-342579 2026-10-02T16:08:31.058820+00:00 EUVD-2026-342579 https://cve.radiocsirt.org/vuln/fkie_cve-2026-7260 fkie_cve-2026-7260 2026-10-02T16:08:31.058833+00:00

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-7260 msrc_CVE-2026-7260 — Stack overflow in phar with circular symlinks 2026-10-02T16:08:31.058869+00:00 msrc_CVE-2026-7260 https://cve.radiocsirt.org/vuln/oesa-2026-3475 OESA-2026-3475 — php security update 2026-10-02T16:08:31.058887+00:00

Affected: openEuler:20.03-LTS-SP4: php, openEuler:22.03-LTS-SP4: php, openEuler:24.03-LTS-SP1: php, openEuler:24.03-LTS-SP3: php, openEuler:24.03-LTS-SP4: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es):

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.(CVE-2026-17543)

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.(CVE-2026-7260)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11418-1 openSUSE-SU-2026:11418-1 — php8-8.5.9-1.1 on GA media 2026-10-02T16:08:31.058942+00:00

php8-8.5.9-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:47200 RHSA-2026:47200 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T16:08:31.058963+00:00

php: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability php: PHP: Denial of Service via circular symbolic links in phar archives php: ext-pgsql: PHP: SQL injection via improper backslash escaping php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()

 https://cve.radiocsirt.org/vuln/rlsa-2026:57539 RLSA-2026:57539 — Important: php:8.3 security, bug fix, and enhancement update 2026-10-02T16:08:31.059013+00:00

Affected: Rocky Linux:9: php-pecl-apcu, Rocky Linux:9: php-pecl-redis6, Rocky Linux:9: php-pecl-rrd, Rocky Linux:9: php-pecl-xdebug3, Rocky Linux:9: php-pecl-zip, Rocky Linux:9: php

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)

* php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.3.33 for CVE-2026-17543 and CVE-2026-7260 in 9.8.z (JIRA:Rocky Linux-223944)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:23121-1 SUSE-SU-2026:23121-1 — Security update for php8 2026-10-02T16:08:31.059055+00:00

Security update for php8

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-7260 UBUNTU-CVE-2026-7260 2026-10-02T16:08:31.059074+00:00

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.04:LTS: php8.5

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2598 WID-SEC-W-2026-2598 — PHP: Mehrere Schwachstellen 2026-10-02T16:08:31.059104+00:00

Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um SQL-Injection durchzuführen, beliebigen Code auszuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.