RHSA-2026:23388HighCVSS 7.7

Red Hat Security Advisory: php security update

Published
June 4, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (7)

CVE-2026-7259 →CVE-2026-7261 →CVE-2026-7262 →CVE-2026-7568 →CVE-2026-6722 →CVE-2026-6735 →CVE-2026-7258 →

📋 Description

CVE-2026-6722 — php: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6735 — PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation CVE-2026-7258 — PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7259 — php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() CVE-2026-7261 — PHP: PHP SoapServer: Memory corruption and information disclosure via incorrect persistence handling CVE-2026-7262 — php: NULL pointer dereference in SOAP apache:Map decoder with missing CVE-2026-7568 — php: signed integer overflow in metaphone()

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 10)
  • php-0:8.3.31-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-0:8.3.31-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-0:8.3.31-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-0:8.3.31-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-0:8.3.31-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-0:8.3.31-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-0:8.3.31-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-0:8.3.31-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-0:8.3.31-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-debuginfo-0:8.3.31-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-debuginfo-0:8.3.31-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-debuginfo-0:8.3.31-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-bcmath-debuginfo-0:8.3.31-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-0:8.3.31-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-0:8.3.31-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-0:8.3.31-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-0:8.3.31-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-debuginfo-0:8.3.31-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-debuginfo-0:8.3.31-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-debuginfo-0:8.3.31-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-cli-debuginfo-0:8.3.31-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-0:8.3.31-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-0:8.3.31-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-0:8.3.31-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-0:8.3.31-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-debuginfo-0:8.3.31-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-debuginfo-0:8.3.31-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-debuginfo-0:8.3.31-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • php-common-debuginfo-0:8.3.31-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Restrict network access to the PHP-FPM status page to trusted internal networks or localhost. This can be achieved by configuring web server access controls (e.g., Apache httpd or Nginx) to deny external access to the status page URL. If the PHP-FPM status page functionality is not required, it should be disabled in the PHP-FPM configuration. Any changes to web server or PHP-FPM configuration may require a service reload or restart to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this vulnerability, implement an encoding validation mechanism to reject the specific encodings and aliases that cause the mismatch between Oniguruma and mbfl. The following encodings and aliases are known to trigger this issue: iso-8859-11 and ISO8859-11, UJIS (EUC-JP alias), GB-2312 (EUC-CN alias), KOI-8R (KOI8 alias), and US_ASCII or ISO646 (ASCII aliases). Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, validate the length of any user-controlled input before passing it to the metaphone() function. Also, verify the PHP and web server configuration to ensure memory limits and maximum request sizes are restricted to below ~2 GiB.

🔗 References (9)