TI-2026-78794 CVE-2026-109619
PHP remote code execution via stale global state
Priority CRITICAL 99KEV
PHP has various global state that temporarily points into request memory.
RHSA-2026:88565
php:7.4 security update
Released 2026-10-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64::php:7.4 +41
Fixes 2 records
Priority CRITICAL 99KEV
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.