Critical Security Update for PHP 8.2: Multiple Vulnerabilities Addressed
Summary
ALSA-2026:1409: Important: php:8.2 security update. Affects apcu-panel versions < 5.1.23-1.module_el9.4.0+65+49ff6472. Fixed in 5.1.23-1.module_el9.4.0+65+49ff6472. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language that is especially suited for web development. It is embedded within HTML and is known for its flexibility and ease of integration with various databases. The recent vulnerabilities discovered in PHP 8.2, particularly in its pgsql extension and SOAP extension, pose significant risks, including potential denial of service and information disclosure, necessitating immediate attention from developers and system administrators.
Vulnerability Detail
The vulnerabilities in PHP 8.2 include a NULL Pointer Dereference in the SOAP extension, which can lead to application crashes, and a heap-based buffer overflow in the array_merge() function, which can be exploited to execute arbitrary code. Additionally, the pgsql extension fails to check for errors during escaping, which can lead to SQL injection attacks. These vulnerabilities can compromise the security of applications, potentially allowing attackers to gain unauthorized access or disrupt services.
How To Fix
Minimum fixed version
5.1.23-1.module_el9.4.0+65+49ff6472
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the affected extensions temporarily until the update can be applied. This can be done by commenting out the respective lines in your php.ini configuration file.
Conclusion
The recent vulnerabilities in PHP 8.2 highlight the importance of maintaining up-to-date software to protect against potential security threats. By promptly applying the necessary updates and utilizing tools like Vulert for monitoring, developers can safeguard their applications against exploitation.
See every vulnerability recorded for apcu-panel →
FAQ
The update addresses multiple vulnerabilities, including a NULL Pointer Dereference in the SOAP extension, a heap-based buffer overflow in array_merge(), and SQL injection risks in the pgsql extension.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
If you cannot update immediately, consider disabling the affected extensions in your php.ini file as a temporary workaround until you can apply the necessary updates.
The vulnerabilities specifically affect PHP version 8.2 and its related packages. It is recommended to update to version 8.2.30 or higher.
For more details, you can refer to the CVE pages listed in the references section of the vulnerability report, or visit the Vulert website for real-time monitoring.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
