ALSA-2026:56969 Important: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

PT-2026-78299

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.12 Description On sites using plain permalinks, the plugin fails to limit the query variables accepted from user input. This allows unauthenticated users to overwrite arbitrary PHP global variables and...

CVE-2026-73364: Deserialization of Untrusted Data

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-78340

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-78353

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An unauthenticated attacker can perform PHP code injection due to the use of the eval function in the optional custom-PHP post-submission handler. The URL parameter = X shortcode is replaced...

PT-2026-78346

Name of the Vulnerable Software and Affected Versions Kalles Addons versions prior to 1.0.7 Description An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the unserialize function, allowing an attacker to manipulate serialized objec...

CVE-2026-67364: Improper Control of Generation of Code

Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms 2.4.3.2 - The form's optional custom-PHP post-submission handler is executed via eval. The URL parameter = X shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attack...

ROS-20260819-73-0074

The vulnerability of the unserialize function in the MediaWiki software, which is used to implement the hypertext environment, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2026-80667

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

CVE-2026-73389: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kalles Addons = 1.0.6 versions...

CVE-2026-75956: Allocation of Resources Without Limits or Throttling

Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...

PT-2026-80737

Name of the Vulnerable Software and Affected Versions mcp/sdk versions 0.5.0 through 0.7.0 Description The HTTP client transport in the MCP PHP SDK reads a Server-Sent Events SSE response stream incrementally and appends data to an in-memory buffer sseBuffer without an upper bound. The buffer is...

CVE-2026-62672: Inefficient Regular Expression Complexity

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-102686)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102686 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versionsfrom 8.2. before 8.2.33, from 8.3. before 8.3.3...

AlmaLinux 9 : php:8.3 (ALSA-2026:48197)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48197 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

RHEL 9 : php:8.2 (RHSA-2026:40416)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40416 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

RHEL 8 : php:7.4 (RHSA-2026:47750)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47750 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

RHEL 9 : php:8.3 (RHSA-2026:48197)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:48197 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

AlmaLinux 8 : php:8.2 (ALSA-2026:47749)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47749 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

RHEL 8 : php:8.2 (RHSA-2026:47749)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47749 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...