Critical SQL Injection and Denial of Service Vulnerabilities in PHP Package
Summary
RLSA-2026:62614: Important: php security, bug fix, and enhancement update. Affects php versions < 0:8.3.33-1.el10_2. Fixed in 0:8.3.33-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP is a widely-used open-source scripting language that is especially suited for web development. It is embedded within HTML and is commonly used in conjunction with the Apache HTTP Server. The PHP package in Rocky Linux 10 is crucial for running dynamic web applications and services. However, it has recently been identified to have critical vulnerabilities that could lead to severe security issues, including SQL injection and denial of service attacks.
Vulnerability Detail
The vulnerabilities identified in the PHP package include a SQL injection flaw due to improper backslash escaping (CVE-2026-17543) and a denial of service vulnerability caused by circular symbolic links in phar archives (CVE-2026-7260). The SQL injection vulnerability allows attackers to manipulate database queries, potentially leading to unauthorized data access or data corruption. The denial of service vulnerability can cause the application to become unresponsive, impacting availability and user experience. Both vulnerabilities pose significant risks to the integrity and availability of applications relying on the PHP package.
How To Fix
Minimum fixed version
0:8.3.33-1.el10_2
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can mitigate the SQL injection risk by ensuring that all user inputs are properly sanitized and validated before being processed in SQL queries. Additionally, avoid using circular symbolic links in phar archives until the package is updated.
Conclusion
The PHP package in Rocky Linux 10 has critical vulnerabilities that require immediate attention. By updating to the latest patched version, users can protect their applications from potential SQL injection and denial of service attacks. It is crucial to stay informed about such vulnerabilities and take proactive measures to secure your software.
See every vulnerability recorded for php →
FAQ
The SQL injection vulnerability can allow attackers to execute arbitrary SQL code, potentially leading to unauthorized access to sensitive data or data manipulation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The denial of service vulnerability may cause your application to become unresponsive or crash, affecting user access and functionality.
Yes, the CVSS score for this vulnerability is 7.4, indicating a high level of severity.
If an immediate update is not possible, ensure that user inputs are sanitized and avoid using circular symbolic links in phar archives as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
