Important: Red Hat Security Advisory: php security, bug fix, and enhancement update

An update for php is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

RLSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

php:8.2 security, bug fix, and enhancement update

An update is available for php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, php-pecl-zip, php-pecl-rrd, module.php, module.php-pecl-zip, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a...

RLSA-2026:62334 Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

php:7.4 security, bug fix, and enhancement update

libzip 1.6.1-1 - update to 1.6.1 - enable lzma support php 7.4.33-6 - Fix leak on double DatePeriod::construct call - Fixed SQL injection via E'...' backslash breakout CVE-2026-17543 - Fixed GHSA-vc5h-9ppw-p5f3 Crash via recursive symlinks CVE-2026-7260 php-pear 1:1.10.13-1 - update PEAR to 1.10....

ALSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

AlmaLinux 9 : php:8.2 (ALSA-2026:61903)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61903 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archive...

Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

php: PHP: Denial of Service via circular symbolic links in phar archives

A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...

RHEL 9 : php (RHSA-2026:61259)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61259 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption i...

CVE-2026-55108

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...

CVE-2026-82252

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

PT-2026-89230

GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. newline injection...

FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory. Composer project reports: Validate package bin paths against path traversal using symlinks...

CVE-2026-81494

GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. newline injection...

CVE-2026-79676

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open instead of nltk.pathsec.open, allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose...

EulerOS Virtualization 2.13.0 : sed (EulerOS-SA-2026-3238)

According to the versions of the sed packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic...

EulerOS Virtualization 2.13.1 : sed (EulerOS-SA-2026-3198)

According to the versions of the sed packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: afs: The setting of ASRELEASEALWAYS for symlinks and mountpoints has been removed. Regular AFS files correctly use afsfileaops, which sets releasefolio as netfsreleasefolio. Therefore, ASRELEASEALWAYS is valid for them when fscac...