Most recent entries from all

ALSA-2026:22142 — Important: php:8.3 security update

Affected: AlmaLinux:9: apcu-panel, AlmaLinux:9: php, AlmaLinux:9: php-bcmath, AlmaLinux:9: php-cli, AlmaLinux:9: php-common, AlmaLinux:9: php-dba, AlmaLinux:9: php-dbg, AlmaLinux:9: php-devel, AlmaLinux:9: php-embedded, AlmaLinux:9: php-enchant and 22 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735) * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262) * php: signed integer overflow in metaphone() (CVE-2026-7568)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-01641

BELL-CVE-2026-7568

Affected: Alpaquita:23: php81, Alpaquita:25: php83, Alpaquita:stream: php83

BIT-libphp-2026-7568 — Signed integer overflow in metaphone()

Affected: Bitnami: libphp

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.

certfr-2026-avi-0553 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque…

certfr-2026-avi-0553

EUVD-2026-337152

fkie_cve-2026-7568

msrc_CVE-2026-7568 — Signed integer overflow in metaphone()

msrc_CVE-2026-7568

OESA-2026-2340 — php security update

Affected: openEuler:20.03-LTS-SP4: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es):

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.(CVE-2026-6722)

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in…

openSUSE-SU-2026:10747-1 — php8-8.5.6-1.1 on GA media

php8-8.5.6-1.1 on GA media

RLSA-2026:22142 — Important: php:8.3 security update

Affected: Rocky Linux:9: php-pecl-apcu, Rocky Linux:9: php-pecl-redis6, Rocky Linux:9: php-pecl-rrd, Rocky Linux:9: php-pecl-xdebug3, Rocky Linux:9: php-pecl-zip, Rocky Linux:9: php

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)

* PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

* php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

* php: signed integer overflow in metaphone() (CVE-2026-7568)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1957-1 — Security update for php8

Security update for php8

UBUNTU-CVE-2026-7568

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:25.10: php8.4, Ubuntu:26.04:LTS: php8.5

WID-SEC-W-2026-1433 — PHP: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.