php:8.3 security update

php 8.3.36-1 - rebase to 8.3.36 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 5.1.21-1 - update to 5.1.21 for PHP 8.1 2070040 php-pecl-redis6 6.1.0-3 - use valkey for tests 6.1.0-2 - ignore 1 ONLINE test 6.1.0-1 - RHEL build 6.1.0-1 - update to 6.1.0 - drop patch merged upstrea...

Oracle Linux 10 : php8.4 (ELSA-2026-87071)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-87071 advisory. 8.4.27-1 - rebase to 8.4.27 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

RHEL 10 : php (RHSA-2026:87070)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87070 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via...

RHEL 10 : php8.4 (RHSA-2026:87071)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87071 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also...

RHEL 9 : php:8.2 (RHSA-2026:87072)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87072 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via...

RHEL 8 : php:8.2 (RHSA-2026:87073)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87073 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via...

RHEL 9 : php:8.3 (RHSA-2026:87079)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87079 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via...

RHEL 9 : php (RHSA-2026:87151)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87151 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792612974)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792612974 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not...

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792616669)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792616669 advisory. - The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-char...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1792611813)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1792611813 advisory. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may...

PT-2026-121491

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...

PT-2026-121492

ast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its auto-update flow, triggered by the Checkmarx’s "VSCode/JetBrains" extensions and by cx scan "sca-realtime". Prior to the fix, the downloaded archive was not...

PT-2026-121511

OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a crafted Terraform resource address. To...

PT-2026-121668

A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory...

PT-2026-121682

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

PT-2026-121677

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request uri parameter to the abstract get request object hook before applying a destination or registration policy;...

PT-2026-121408

External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...

Oracle Linux 9 : php (ELSA-2026-87151)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-87151 advisory. - Fix IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison CVE-2026-91768 - Fix Various packet overreads in mysqlnd wire...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_87080)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687080 advisory. php: php: Out-of-bounds read via empty HTTP redirect Location header CVE-2026-93682 php: PHP: Archive entry injection via integer overflow in TAR parser...