Critical Security Update for PHP: Denial of Service and Remote Code Execution Vulnerabilities
Summary
RLSA-2026:87079: Important: php:8.3 security update. Affects php versions < 0:8.3.36-1.module+el9.8.0+40396+4e680bb7. Fixed in 0:8.3.36-1.module+el9.8.0+40396+4e680bb7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is particularly known for its ability to embed HTML and is commonly used in conjunction with the Apache HTTP Server. The recent vulnerabilities identified in PHP versions prior to 8.3.36 expose applications to significant risks, including Denial of Service (DoS) and Remote Code Execution (RCE), which can compromise the integrity and availability of web applications.
Vulnerability Detail
The vulnerabilities stem from issues in the SOAP parser that allows for unbounded recursion, leading to a Denial of Service (CVE-2026-91765). Additionally, an Out Of Memory (OOM) condition during request parsing can lead to memory corruption and potential Remote Code Execution (CVE-2026-109618). Furthermore, a flaw in the fatal error handling can retain stale request states, resulting in a use-after-free vulnerability (CVE-2026-109619). These vulnerabilities can be exploited by attackers to crash the application or execute arbitrary code, posing severe risks to system security.
How To Fix
Minimum fixed version
0:8.3.36-1.module+el9.8.0+40396+4e680bb7
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to limit the depth of recursion in SOAP requests. This can help mitigate the risk of Denial of Service attacks until the package can be updated.
Conclusion
In summary, the recent vulnerabilities in PHP pose significant risks to web applications, including Denial of Service and Remote Code Execution. It is essential to update to the latest patched versions to ensure the security and integrity of your applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for php →
FAQ
The CVSS score of the vulnerability is 8.1, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The vulnerabilities can lead to Denial of Service, memory corruption, and Remote Code Execution, which can severely compromise the security and availability of applications.
Yes, you should upgrade to PHP version 8.3.36-1.module+el9.8.0+40396+4e680bb7 or later to mitigate the vulnerabilities.
Implement input validation to limit recursion depth in SOAP requests as a temporary workaround until you can perform the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
