Critical Security Update for PHP 7.4: Multiple Vulnerabilities Addressed
Summary
RLSA-2026:87080: Important: php:7.4 security update. Affects libzip across 2 version ranges.
< 0:1.6.1-1.module+el8.10.0+1912+72767185
< 0:1.6.1-1.module+el8.10.0+1604+6558efc7
Fixed in 0:1.6.1-1.module+el8.10.0+1912+72767185 or 0:1.6.1-1.module+el8.10.0+1604+6558efc7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It is embedded within HTML and is commonly used in conjunction with the Apache HTTP Server. The PHP 7.4 version is known for its performance improvements and enhanced security features. However, it has recently been identified as vulnerable to multiple security issues that could lead to serious consequences, including denial of service, information disclosure, and remote code execution.
Vulnerability Detail
The vulnerabilities in PHP 7.4 stem from various issues, including out-of-bounds reads, integer overflows, and improper error handling. These vulnerabilities can allow attackers to exploit the system, leading to potential denial of service, unauthorized access to sensitive information, and even remote code execution. Notable vulnerabilities include CVE-2026-93682, which allows for out-of-bounds reads via empty HTTP redirect Location headers, and CVE-2026-109618, which can lead to memory corruption and remote code execution during request parsing.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libzip-
< 0:1.6.1-1.module+el8.10.0+1604+6558efc70:1.6.1-1.module+el8.10.0+1604+6558efc7 -
< 0:1.6.1-1.module+el8.10.0+1912+727671850:1.6.1-1.module+el8.10.0+1912+72767185
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider disabling features that utilize the vulnerable components until the update can be applied. For instance, if your application relies on SOAP services, you may disable them to mitigate the risk until the patch is implemented.
Conclusion
The vulnerabilities identified in PHP 7.4 pose significant risks to applications relying on this version. It is crucial to update to the latest patched version to safeguard against potential exploits. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.
See every vulnerability recorded for libzip →
FAQ
The main vulnerabilities include out-of-bounds reads, integer overflows, denial of service, and potential remote code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for the vulnerabilities in PHP 7.4 is 8.1, indicating a high severity level.
It is not safe to continue using PHP 7.4 without applying the necessary updates, as the vulnerabilities can be exploited by attackers.
If you cannot update immediately, consider implementing workarounds such as disabling vulnerable features or components until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for libzip.
