Most recent entries from all

ALSA-2026:56969 — Important: php8.4 security, bug fix, and enhancement update

Affected: AlmaLinux:10: php8.4, AlmaLinux:10: php8.4-bcmath, AlmaLinux:10: php8.4-cli, AlmaLinux:10: php8.4-common, AlmaLinux:10: php8.4-dba, AlmaLinux:10: php8.4-dbg, AlmaLinux:10: php8.4-devel, AlmaLinux:10: php8.4-embedded, AlmaLinux:10: php8.4-enchant, AlmaLinux:10: php8.4-ffi and 15 more

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) * php: PHP: Arbitrary code execution via out-of-bounds write in bccomp() (CVE-2026-17544)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.4.24 for CVE-2026-17543 and CVE-2026-7260 and CVE-2026-17544 in 10.2.z (JIRA:AlmaLinux-223949)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-7260

Affected: Alpaquita:25: php83, Alpaquita:stream: php83

BIT-libphp-2026-7260 — Stack overflow in phar with circular symlinks

Affected: Bitnami: libphp

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

certfr-2026-avi-0952 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque…

certfr-2026-avi-0952

EUVD-2026-342579

fkie_cve-2026-7260

msrc_CVE-2026-7260 — Stack overflow in phar with circular symlinks

msrc_CVE-2026-7260

OESA-2026-3475 — php security update

Affected: openEuler:20.03-LTS-SP4: php, openEuler:22.03-LTS-SP4: php, openEuler:24.03-LTS-SP1: php, openEuler:24.03-LTS-SP3: php, openEuler:24.03-LTS-SP4: php

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.(CVE-2026-17543)

openSUSE-SU-2026:11418-1 — php8-8.5.9-1.1 on GA media

php8-8.5.9-1.1 on GA media

RHSA-2026:47200 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

php: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability php: PHP: Denial of Service via circular symbolic links in phar archives php: ext-pgsql: PHP: SQL injection via improper backslash escaping php: PHP: Arbitrary code execution via out-of-bounds write in bccomp()

RLSA-2026:57539 — Important: php:8.3 security, bug fix, and enhancement update

Affected: Rocky Linux:9: php-pecl-apcu, Rocky Linux:9: php-pecl-redis6, Rocky Linux:9: php-pecl-rrd, Rocky Linux:9: php-pecl-xdebug3, Rocky Linux:9: php-pecl-zip, Rocky Linux:9: php

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543)

* php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.3.33 for CVE-2026-17543 and CVE-2026-7260 in 9.8.z (JIRA:Rocky Linux-223944)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23121-1 — Security update for php8

Security update for php8

UBUNTU-CVE-2026-7260

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.04:LTS: php8.5

WID-SEC-W-2026-2598 — PHP: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um SQL-Injection durchzuführen, beliebigen Code auszuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.