Fedora Account System
Red Hat Associate
Red Hat Customer
GHSA - https://github.com/php/php-src/security/advisories/GHSA-h37m-fxqh-w76h Found a crash while investigating https://github.com/php/php-src/security/advisories/GHSA-626f-5vcj-8h2p. An OOM at the wrong time can leave zend_array s in a corrupted state, and cause a zval_ptr_dtor() on uninitialized memory during shutdown. This seems critical as this can be triggered during input parsing. Details _zend_hash_str_add_or_update_i() updates ht->nNumUsed before initializing the bucket, and then allocates a zend_string for the key with zend_string_init() . If zend_string_init() OOMs, the zend_array is left with one uninitialized bucket. idx = ht->nNumUsed++; ht->nNumOfElements++; p = ht->arData + idx; p->key = key = zend_string_init(str, len, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT); During shutdown, i_zval_ptr_dtor() is called on the uninitialized bucket, which might contain data from user inputs
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:87080 https://access.redhat.com/errata/RHSA-2026:87080
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:87151 https://access.redhat.com/errata/RHSA-2026:87151
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:87071 https://access.redhat.com/errata/RHSA-2026:87071
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:87070 https://access.redhat.com/errata/RHSA-2026:87070
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:87073 https://access.redhat.com/errata/RHSA-2026:87073
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:87079 https://access.redhat.com/errata/RHSA-2026:87079
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:87072 https://access.redhat.com/errata/RHSA-2026:87072
Note for RHEL 7 users: the bulletin RHSB-2026-013 (updated on 22 Oct 2026, 15:47 UTC) lists RHEL 7 as "Only affected by CVE-2026-109619 — In a default configuration, the version of PHP in use is vulnerable". The CSAF VEX file for this CVE, generated earlier on 22 Oct (05:04 UTC), still lists red_hat_enterprise_linux_7:php as known_not_affected, so the two sources currently disagree: https://access.redhat.com/security/vulnerabilities/RHSB-2026-013 https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109619.json The known path on php-5.4.16 is session upload progress, which is enabled by default. As the upstream advisory describes, setting session.upload_progress.enabled = 0 in php.ini (not with ini_set()) and restarting every process that runs PHP closes that path. For systems that will not get a vendor update for php, for example CentOS 7, I have published an unofficial backport of the upstream minimal mitigation (php-src 712e60f9ed) as a rebuilt vendor package, php-5.4.16-48.el7.php2shell.1. On PHP 5.4 it also disables session upload progress in the code. It is not affiliated with or supported by Red Hat: https://www.openwall.com/lists/oss-security/2026/10/22/27 https://github.com/alvm/php2shell-eol-backport
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:88533 https://access.redhat.com/errata/RHSA-2026:88533
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:88532 https://access.redhat.com/errata/RHSA-2026:88532
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:88565 https://access.redhat.com/errata/RHSA-2026:88565
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:88561 https://access.redhat.com/errata/RHSA-2026:88561
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:88659 https://access.redhat.com/errata/RHSA-2026:88659
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:88693 https://access.redhat.com/errata/RHSA-2026:88693
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:88725 https://access.redhat.com/errata/RHSA-2026:88725
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:88720 https://access.redhat.com/errata/RHSA-2026:88720
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:88834 https://access.redhat.com/errata/RHSA-2026:88834
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:88835 https://access.redhat.com/errata/RHSA-2026:88835
Hi, will there be an update for php:8.1 module stream since that one is available in RHEL 9? Best regards
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:89111 https://access.redhat.com/errata/RHSA-2026:89111