Critical Security Flaw in PHP: Denial of Service and Remote Code Execution Vulnerabilities
Summary
RLSA-2026:87070: Important: php security update. Affects php versions < 0:8.3.36-1.el10_2. Fixed in 0:8.3.36-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is particularly known for its ability to embed HTML and interact with databases, making it a cornerstone of many web applications. However, recent vulnerabilities have exposed PHP to significant security risks, including denial of service and remote code execution, which can severely impact web applications relying on this technology.
Vulnerability Detail
The vulnerabilities in PHP stem from issues in its SOAP parser and request handling mechanisms. Specifically, CVE-2026-91765 allows for denial of service through unbounded recursion, while CVE-2026-109618 leads to out-of-memory (OOM) conditions during request parsing, resulting in memory corruption and potential remote code execution. Additionally, CVE-2026-109619 involves a use-after-free scenario due to improper handling of fatal errors, which can also lead to security breaches. These vulnerabilities can be exploited by attackers to disrupt services or execute arbitrary code on affected systems.
How To Fix
Minimum fixed version
0:8.3.36-1.el10_2
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the input size for SOAP requests or disable the SOAP extension if it is not needed for your application. This can be done by modifying the php.ini configuration file to set 'soap.wsdl_cache_enabled = 0' and 'soap.wsdl_cache_ttl = 0'.
Conclusion
In summary, the recent vulnerabilities in PHP pose significant risks to web applications, including denial of service and remote code execution. It is crucial to update to the latest patched version to protect your systems. Implementing workarounds can provide temporary relief, but a complete fix requires updating the software.
See every vulnerability recorded for php →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerabilities can lead to denial of service, memory corruption, and remote code execution, which can compromise the security and availability of your web applications.
Yes, you can implement input size restrictions and disable unnecessary features like SOAP to reduce exposure until an update can be applied.
The Rocky Enterprise Software Foundation and Red Hat are responsible for providing security updates and patches for PHP in the Rocky Linux ecosystem.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
