TI-2026-78794 CVE-2026-109619
PHP remote code execution via stale global state
Priority CRITICAL 99KEV
PHP has various global state that temporarily points into request memory.
RHSA-2026:88532
php:7.4 security update
Released 2026-10-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream E4S (v.8.8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4 +47
- Red Hat Enterprise Linux AppStream TUS (v.8.8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
Fixes 2 records
Priority CRITICAL 99KEV
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.