Critical Security Update for PHP: Important Vulnerabilities in Multiple Packages
Summary
ALSA-2026:1429: Important: php:8.3 security update. Affects apcu-panel versions < 5.1.23-1.module_el9.6.0+151+5f31e576. Fixed in 5.1.23-1.module_el9.6.0+151+5f31e576. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It allows developers to create dynamic web pages and applications. The language is often embedded within HTML and is compatible with various databases, making it a popular choice for server-side programming. However, recent vulnerabilities have been identified in PHP and its related packages, which could lead to severe security issues if not addressed promptly.
Vulnerability Detail
The vulnerabilities identified include a heap-based buffer overflow in the array_merge() function (CVE-2025-14178), information disclosure via the getimagesize() function when reading multi-chunk images (CVE-2025-14177), and a denial of service via an invalid character sequence in PDO PostgreSQL prepared statements (CVE-2025-14180). These vulnerabilities can lead to unauthorized access, data leakage, and service interruptions, posing significant risks to applications relying on affected PHP packages.
How To Fix
Minimum fixed version
5.1.23-1.module_el9.6.0+151+5f31e576
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the affected functions or using alternative methods to handle image processing and database interactions until the packages can be updated. However, this is not a long-term solution and should only be used if immediate updates are not feasible.
Conclusion
In summary, the recent vulnerabilities in PHP and its related packages pose significant risks to web applications. It is crucial to update to the patched versions of the affected packages to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for apcu-panel →
FAQ
The main vulnerabilities include a heap-based buffer overflow, information disclosure through the getimagesize() function, and denial of service via invalid character sequences in prepared statements.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, consider disabling the affected functions or using alternative methods as a temporary workaround.
Vulert is a service that monitors and alerts users in real-time for open-source vulnerabilities in software, using just a manifest file like package-lock.json.
It is recommended to regularly check for vulnerabilities, especially after updates or when new vulnerabilities are disclosed.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
