Critical Security Flaw in PHP Package: Denial of Service and Remote Code Execution Vulnerabilities
Summary
RLSA-2026:87072: Important: php:8.2 security update. Affects php versions < 0:8.2.35-1.module+el9.8.0+40395+2f706e64. Fixed in 0:8.2.35-1.module+el9.8.0+40395+2f706e64. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It is embedded within HTML and is often utilized with the Apache HTTP Server. PHP's flexibility and ease of integration with databases make it a popular choice for developers. However, recent vulnerabilities have raised concerns regarding its security, particularly in version 8.2, which is affected by critical issues that could lead to denial of service and remote code execution.
Vulnerability Detail
The vulnerabilities in PHP version 8.2 stem from multiple issues: a denial of service vulnerability caused by unbounded recursion in the SOAP parser (CVE-2026-91765), an out-of-memory (OOM) bailout during request parsing that can lead to memory corruption and remote code execution (CVE-2026-109618), and a fatal error handling flaw that retains stale request state, resulting in a use-after-free condition (CVE-2026-109619). These vulnerabilities can be exploited by attackers to crash the server or execute arbitrary code, posing significant risks to applications relying on PHP.
How To Fix
Minimum fixed version
0:8.2.35-1.module+el9.8.0+40395+2f706e64
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the SOAP parser or limiting the input size to mitigate the risk of denial of service attacks. However, these are temporary measures and should not replace a proper update.
Conclusion
The vulnerabilities identified in PHP version 8.2 present serious security risks, including denial of service and remote code execution. It is crucial for users to update to the latest patched versions of PHP and its related packages to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for php →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploiting these vulnerabilities can lead to denial of service, memory corruption, and remote code execution, which can compromise the security and functionality of applications.
Using PHP version 8.2 without applying the necessary updates poses significant security risks. It is advisable to update as soon as possible.
If immediate updating is not possible, consider implementing workarounds such as disabling vulnerable features or limiting input sizes until you can apply the updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
