Most recent entries from all

certfr-2026-ale-014 — Le 20 octobre 2026, PHP a publié une communication concernant deux vulnérabilités critiques. L'éditeur annonce la dispo…

certfr-2026-ale-014

certfr-2026-avi-1359 — De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer une exécution de…

certfr-2026-avi-1359

fkie_cve-2026-109619

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

NCSC-2026-0443 — Kwetsbaarheden verholpen in PHP

NCSC-2026-0443

RHSA-2026:87080 — Red Hat Security Advisory: php:7.4 security update

php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser php: PHP: Denial of Service via heap buffer overflow in SOAP client php: PHP: Archive entry injection via integer overflow in TAR parser php: php: Denial of Service via unbounded recursion in SOAP parser php: php: Credential disclosure via cross-origin HTTP redirects php: php: Information disclosure via crafted TLS server certificate php: php: Access control bypass via partial IPv6 address comparison php: php: Server impersonation via Common Name fallback in TLS verification php: php: Information disclosure via out-of-bounds read in stream filters php: php: Out-of-bounds read via empty HTTP redirect Location header php: OOM bailout during request parsing leads to memory corruption and RCE php: fatal error handling retains stale request state leading to use-after-free

UBUNTU-CVE-2026-109619

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:16.04:LTS: php7.0, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:26.10: php8.5, Ubuntu:26.04:LTS: php8.5

Remote code execution issue

VA-26-295-01 — PHP insecure error handling and state management

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. In some contexts, the code before the allocation does not properly account for a early exit and leaves reachable request memory in an uninitialized or otherwise invalid state. The request shutdown procedure may then read or branch on the uninitialized memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Application-independent, complete remote code execution has been validated over HTTP against mod_php with default PHP input and memory limits and normal prefork workers. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP contains error handling, Session, object and extension state that is retained by a worker but points to memory owned by one request. That state must be reset before the request memory is released. Some input, configuration, Session and error handling operations run before normal initialization of the next request. They can trust stale state left by the previous request before initialization has a chance to replace it, causing a use after free. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

WID-SEC-W-2026-4055 — PHP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.