RHSA-2026:34354HighCVSS 7.7

Red Hat Security Advisory: php:7.4 security update

Published
July 1, 2026
Last Modified
November 5, 2026

🔗 CVE IDs covered (6)

CVE-2026-6735 →CVE-2026-7258 →CVE-2026-7261 →CVE-2026-7262 →CVE-2026-7568 →CVE-2026-6722 →

📋 Description

CVE-2026-6722 — php: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability CVE-2026-6735 — PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation CVE-2026-7258 — PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7261 — PHP: PHP SoapServer: Memory corruption and information disclosure via incorrect persistence handling CVE-2026-7262 — php: NULL pointer dereference in SOAP apache:Map decoder with missing CVE-2026-7568 — php: signed integer overflow in metaphone()

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 8)
  • apcu-panel-0:5.1.18-1.module+el8.10.0+22485+a3539972.noarch (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.src (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-debugsource-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-devel-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.aarch64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.ppc64le (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.s390x (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libzip-tools-debuginfo-0:1.6.1-1.module+el8.10.0+22485+a3539972.x86_64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • php-0:7.4.33-4.module+el8.10.0+24352+91532d3e.aarch64 (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • php-0:7.4.33-4.module+el8.10.0+24352+91532d3e.ppc64le (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • php-0:7.4.33-4.module+el8.10.0+24352+91532d3e.s390x (php:7.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Restrict network access to the PHP-FPM status page to trusted internal networks or localhost. This can be achieved by configuring web server access controls (e.g., Apache httpd or Nginx) to deny external access to the status page URL. If the PHP-FPM status page functionality is not required, it should be disabled in the PHP-FPM configuration. Any changes to web server or PHP-FPM configuration may require a service reload or restart to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, validate the length of any user-controlled input before passing it to the metaphone() function. Also, verify the PHP and web server configuration to ensure memory limits and maximum request sizes are restricted to below ~2 GiB.

🔗 References (10)