ALSA-2026:87080: PHP security update for AlmaLinux 8
Summary
ALSA-2026:87080: Security flaws can expose credentials and information, bypass access controls, cause service outages, corrupt memory, or enable remote code execution. Affects apcu-panel versions < 5.1.18-1.module_el8.6.0+2750+78feabcb. Fixed in 5.1.18-1.module_el8.6.0+2750+78feabcb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language in the AlmaLinux:8 ecosystem. It is commonly used with the Apache HTTP Server to build web applications and process server-side requests. This advisory covers PHP and related packages, including extensions and supporting libraries, with security fixes across multiple components.
Vulnerability Detail
The reported flaws can cause denial of service, credential or information disclosure, access control bypass, memory corruption, and remote code execution. The advisory identifies issues in components including the SOAP client and parser, TAR parser, TLS verification, stream filters, and request parsing. Other listed defects involve HTTP redirects, the mysqlnd wire protocol parser, and stale request state after fatal errors. The advisory links these issues to related CVE records.
How To Fix
Minimum fixed version
5.1.18-1.module_el8.6.0+2750+78feabcb
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to PHP applications and disable exposed PHP features that process untrusted archives, SOAP requests, or remote TLS connections until the affected packages can be upgraded. Apply the mitigation only where those features are in use.
Conclusion
Upgrade affected packages to their listed minimum fixed builds for the applicable AlmaLinux 8 release line. The advisory covers PHP and related packages, so verify each installed package against its own fixed version rather than relying on one version for all components. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for apcu-panel →
FAQ
The advisory marks affected package ranges as introduced at 0 and lists package-specific fixed builds; check the installed package against its release line.
The PHP flaws can expose credentials or information, bypass access controls, disrupt service, corrupt memory, and potentially enable remote code execution.
Upgrade each affected package to its listed minimum fixed build for the applicable release line; no single upgrade command was supplied.
Restrict access to PHP applications and disable exposed features that handle untrusted archives, SOAP requests, or remote TLS connections until upgrading.
First inspect the installed package inventory or manifest for affected package names and compare versions with the advisory. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
