ALSA-2026:87079: PHP security update addresses denial of service and memory safety flaws
Summary
ALSA-2026:87079: Malformed requests can trigger denial of service, memory corruption, remote code execution, or use-after-free in affected PHP components. Affects apcu-panel versions < 5.1.23-1.module_el9.6.0+151+5f31e576. Fixed in 5.1.23-1.module_el9.6.0+151+5f31e576. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a scripting language in the AlmaLinux:9 ecosystem, commonly embedded in HTML and used with the Apache HTTP Server. It supports server-side application development and is distributed through core packages and extensions, including SOAP. This advisory covers PHP and related packages available for AlmaLinux:9.
Vulnerability Detail
The advisory describes denial of service, memory corruption with remote code execution, and use-after-free vulnerabilities in PHP. Unbounded recursion in the SOAP parser can cause denial of service; an out-of-memory bailout during request parsing can lead to memory corruption and remote code execution; and fatal error handling can retain stale request state, resulting in use-after-free. The listed issues are CVE-2026-91765, CVE-2026-109618, and CVE-2026-109619.
How To Fix
Minimum fixed version
5.1.23-1.module_el9.6.0+151+5f31e576
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
AI-generated workaround (not vendor-documented): Restrict access to PHP services and disable SOAP functionality where it is not required until affected packages can be upgraded. This reduces exposure but does not replace applying the package updates.
Conclusion
Upgrade affected packages to their applicable minimum fixed builds; the fix depends on the package and release line. The advisory lists fixes for PHP and related extensions, so check each installed package against its corresponding fixed build. Vulert monitors the dependencies in a manifest file like package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for apcu-panel →
FAQ
The advisory marks packages introduced at version 0 as affected until their listed fixed builds; affected packages include PHP and related extensions.
The PHP flaws can cause denial of service, memory corruption leading to remote code execution, and use-after-free.
Upgrade each affected package to its minimum fixed build; the PHP core packages are fixed at 8.3.36-1.module_el9.8.0+330+fdc30075.
Restrict access to PHP services and disable SOAP where unnecessary; this AI-generated mitigation is not vendor-documented and does not replace upgrading.
Inspect the installed package inventory and application manifest or SBOM for PHP and related packages. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
