Critical Remote Code Execution and Denial of Service Vulnerabilities in PHP Packages
Summary
ALSA-2026:33449: Important: php security update. Affects php versions < 8.0.30-6.el9_8. Fixed in 8.0.30-6.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language widely used for web development, particularly with the Apache HTTP Server. It offers a range of functionalities including server-side scripting, command-line scripting, and writing desktop applications. The recent vulnerabilities identified in various PHP packages, including php-soap, php-fpm, and others, expose systems to significant security risks, including remote code execution and denial of service attacks.
Vulnerability Detail
The vulnerabilities stem from multiple issues within the PHP ecosystem, including a use-after-free vulnerability in the php-soap extension (CVE-2026-6722), which allows attackers to execute arbitrary code remotely. Other vulnerabilities include improper handling of signed characters leading to denial of service (CVE-2026-7258), and cross-site scripting vulnerabilities due to inadequate URL sanitation in PHP-FPM (CVE-2026-6735). These vulnerabilities can lead to severe ramifications, including unauthorized access to sensitive data, service disruptions, and potential system compromise.
How To Fix
Minimum fixed version
8.0.30-6.el9_8
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected PHP extensions until the packages can be updated. This can be done by commenting out the relevant lines in your PHP configuration file (php.ini) or by using the following command to disable specific extensions:
sudo dnf remove php-soap php-fpm
However, this is not a permanent solution and should only be used until the packages are updated.
Conclusion
The identified vulnerabilities in PHP packages pose significant security risks, including remote code execution and denial of service. It is crucial for users to update their PHP installations to the patched versions to mitigate these risks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for php →
FAQ
The vulnerabilities can lead to remote code execution, denial of service, and cross-site scripting attacks, potentially compromising sensitive data and disrupting services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, consider disabling the affected extensions as a temporary workaround until you can apply the necessary updates.
Yes, the vulnerabilities have been documented, and proof-of-concept exploits may be available, making it critical to address them promptly.
Detailed information can be found on the CVE pages linked in the vulnerability report, which provide insights into the impact and technical details.
Related vulnerabilities
Recent vulnerabilities recorded for php.
