CentOS Linux 8.5 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS8.5:CLSA-2026:1778751841)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1778751841 advisory. - In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it...

PT-2026-105146

php openssl matches wildcard name in ext/openssl/xp ssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes th...

PT-2026-105136

php openssl matches wildcard name in ext/openssl/xp ssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes th...

CVE-2026-97284: Deserialization of Untrusted Data

Contributor PHP Object Injection in Icegram = 3.1.31 versions...

PT-2026-105150

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

PT-2026-105116

php openssl matches wildcard name in ext/openssl/xp ssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes th...

PT-2026-105133

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-94390: Deserialization of Untrusted Data

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_62334)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662334 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives...

CentOS Linux 8.4 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS8.4:CLSA-2026:1769164237)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1769164237 advisory. - In PHP versions:8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1, a heap buffer overflow...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2026_22142)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202622142 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2026_22143)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202622143 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_22305)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202622305 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2026_1429)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261429 advisory. php: heap-based buffer overflow in arraymerge CVE-2025-14178 php: PHP: Information disclosure via getimagesize function when reading multi-chunk images...

CVE-2026-53953: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

PT-2026-103667

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...

PT-2026-103884

Editor PHP Object Injection in Hide Shipping Method For WooCommerce = 1.5.4 versions...

PT-2026-103894

Contributor PHP Object Injection in Icegram = 3.1.31 versions...

PT-2026-103988

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php-pecl-apcu / php-pecl-apcu-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_10949)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410949 advisory. php: host/secure cookie bypass due to partial CVE-2022-31629 fix CVE-2024-2756 php: passwordverify can erroneously return true, opening ATO risk...