Critical Security Update for PHP 8.4: Multiple Vulnerabilities Addressed
Summary
RLSA-2026:22649: Important: php8.4 security update. Affects php8.4 versions < 0:8.4.21-1.el10_2. Fixed in 0:8.4.21-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP 8.4 is an HTML-embedded scripting language widely used for developing dynamic web pages. It simplifies the process of creating database-enabled web applications and is a popular alternative to CGI scripts. However, like any software, it is susceptible to vulnerabilities that can compromise its security and functionality.
Vulnerability Detail
The vulnerabilities in PHP 8.4 include a Denial of Service (DoS) due to improper handling of signed characters in ctype functions, a Cross-Site Scripting (XSS) vulnerability in PHP-FPM due to inadequate URL sanitation, a NULL pointer dereference in the SOAP apache:Map decoder, a signed integer overflow in the metaphone() function, a denial of service via DOMNode::C14N(), and a global buffer over-read in mb_convert_encoding() with attacker-supplied encoding. These vulnerabilities can lead to severe consequences, including service disruption, data exposure, and exploitation of the web application.
How To Fix
Minimum fixed version
0:8.4.21-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you may restrict access to the affected PHP functionalities or disable the features that are vulnerable until the update can be applied. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The vulnerabilities in PHP 8.4 pose significant risks to web applications, making it crucial for developers to apply the necessary updates promptly. By following the outlined steps to update and monitor your applications, you can mitigate the potential impacts of these vulnerabilities.
See every vulnerability recorded for php8.4 →
FAQ
The main vulnerabilities include Denial of Service, Cross-Site Scripting, NULL pointer dereference, signed integer overflow, and global buffer over-read.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for these vulnerabilities is 8.2, indicating a high severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing temporary workarounds such as restricting access to vulnerable functionalities.
References
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
