TI-2026-78794 CVE-2026-109619
PHP remote code execution via stale global state
Priority CRITICAL 99KEV
PHP has various global state that temporarily points into request memory.
RHSA-2026:87072
php:8.2 security update
Released 2026-10-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) apcu-panel-5.1.23-1.module+el9.7.0+24111+199d2cc4.noarch::php:8.2, php-8.2.35-1.module+el9.8.0+25111+a1450321.aarch64::php:8.2, php-8.2.35-1.module+el9.8.0+25111+a1450321.ppc64le::php:8.2 +47
Fixes 3 records
Priority CRITICAL 99KEV
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.
Priority LOW 39
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit.