Critical PHP Vulnerability: Denial of Service and Remote Code Execution Risks
Summary
RLSA-2026:87151: Important: php security update. Affects php versions < 0:8.0.30-8.el9_8.1. Fixed in 0:8.0.30-8.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It is embedded within HTML and is commonly utilized with the Apache HTTP Server. PHP enables developers to create dynamic web pages and applications efficiently. However, recent vulnerabilities have been identified that could compromise the security of applications relying on PHP, particularly in version 8.0.30 and earlier.
Vulnerability Detail
The vulnerabilities stem from issues in the PHP SOAP parser, which can lead to a Denial of Service (DoS) through unbounded recursion (CVE-2026-91765). Additionally, an Out of Memory (OOM) bailout during request parsing can result in memory corruption and potential Remote Code Execution (RCE) (CVE-2026-109618). Another critical issue involves fatal error handling that retains stale request state, leading to a use-after-free vulnerability (CVE-2026-109619). These vulnerabilities can allow attackers to exploit the PHP environment, potentially leading to unauthorized access and control over affected systems.
How To Fix
Minimum fixed version
0:8.0.30-8.el9_8.1
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the SOAP parser if it is not essential for your application. This can help mitigate the risk of exploitation until the package is updated. Additionally, monitor your application for unusual behavior that may indicate an attempted attack.
Conclusion
In summary, the identified vulnerabilities in PHP pose significant risks, including Denial of Service and Remote Code Execution. It is crucial for developers and system administrators to update to the latest patched version of PHP to safeguard their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for open-source vulnerabilities.
See every vulnerability recorded for php →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
Failure to address this vulnerability could lead to Denial of Service attacks, memory corruption, and unauthorized remote code execution, compromising the security of your application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing workarounds such as disabling vulnerable features and closely monitoring your application for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
