ALSA-2026:87072: AlmaLinux 9 PHP security update addresses multiple flaws
Summary
ALSA-2026:87072: Unbounded recursion can cause denial of service, while request-parsing and stale-state flaws can lead to memory corruption, remote code execution, and use-after-free. Affects apcu-panel versions < 5.1.23-1.module_el9.4.0+65+49ff6472. Fixed in 5.1.23-1.module_el9.4.0+65+49ff6472. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a scripting language in the AlmaLinux:9 ecosystem, commonly used with the Apache HTTP Server. It embeds code in HTML and supports web application development. This advisory covers the PHP-related packages apcu-panel, php-pecl-apcu, php-pecl-apcu-devel, php-pecl-rrd, php-pecl-xdebug3, and php-pecl-zip.
Vulnerability Detail
The advisory describes denial of service, memory corruption with remote code execution, and use-after-free vulnerabilities in PHP. Unbounded recursion in the SOAP parser can cause denial of service; an out-of-memory bailout during request parsing can lead to memory corruption and remote code execution; and fatal error handling can retain stale request state, resulting in use-after-free. The advisory lists CVE-2026-91765, CVE-2026-109618, and CVE-2026-109619 as related identifiers.
How To Fix
Minimum fixed version
5.1.23-1.module_el9.4.0+65+49ff6472
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to affected PHP services while arranging package updates, and limit exposure of endpoints that process untrusted requests. The advisory does not document a workaround.
Conclusion
Upgrade each affected package to its listed minimum fixed version; the required version depends on the package. The advisory provides no upgrade command for this ecosystem. Review the installed package set and apply the corresponding fixed package versions. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for apcu-panel →
FAQ
ALSA-2026:87072 affects the listed packages from their introduced versions; fixed versions vary by package, as specified in the advisory.
ALSA-2026:87072 describes denial of service, memory corruption leading to remote code execution, and use-after-free.
Upgrade each affected package to its listed minimum fixed version; the required version depends on the package.
Restrict access to affected PHP services and limit exposure of endpoints processing untrusted requests until packages can be upgraded.
Check installed AlmaLinux packages or review your dependency records for the affected package names. Vulert can scan a manifest or SBOM and monitor the dependency; check Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
