Critical Security Update for PHP: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:23388: Important: php security update. Affects php versions < 8.3.31-1.el10_2. Fixed in 8.3.31-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is particularly known for its ability to embed into HTML and is commonly used with the Apache HTTP Server. The recent vulnerabilities identified in PHP could lead to serious security issues, including denial of service and cross-site scripting attacks, making it essential for users to stay updated with the latest security patches.
Vulnerability Detail
The vulnerabilities in PHP stem from improper handling of signed characters in ctype functions, leading to potential denial of service (CVE-2026-7258). Additionally, a cross-site scripting vulnerability exists in PHP-FPM due to improper URL sanitation (CVE-2026-6735). Other issues include NULL pointer dereferences in php_mb_check_encoding() and SOAP apache:Map decoder (CVE-2026-7259, CVE-2026-7262), and a signed integer overflow in metaphone() (CVE-2026-7568). These vulnerabilities can be exploited by attackers to disrupt services or execute malicious scripts, posing significant risks to applications relying on PHP.
How To Fix
Minimum fixed version
8.3.31-1.el10_2
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable specific PHP functions or limit access to vulnerable features until the update is applied. For instance, disabling PHP-FPM or restricting access to ctype functions can mitigate some risks. However, these are not long-term solutions and should only be used until the patch is implemented.
Conclusion
The recent vulnerabilities in PHP highlight the importance of maintaining up-to-date software to protect against potential security threats. By promptly applying the necessary updates and following best practices, users can safeguard their applications from exploitation.
See every vulnerability recorded for php →
FAQ
The vulnerabilities include denial of service, cross-site scripting, and NULL pointer dereferences, which can lead to service disruptions and security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, consider implementing workarounds such as disabling vulnerable functions or restricting access to affected features.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be exploited by attackers to disrupt services or execute malicious code.
It is recommended to regularly check for updates and security advisories for PHP and other critical packages to ensure your applications remain secure.
Related vulnerabilities
Recent vulnerabilities recorded for php.
