Skip to content
OpenAdvisories
High 1 exploited CVE ELSA-2026-88693 1 CVE

Important: php security update (Oracle Linux 7)

Published Oct 29, 2026 · Updated Oct 29, 2026

Ecosystem: Oracle Linux

Summary

[5.4.16-48.0.1]
- Backport fix for CVE-2026-109619 [Orabug: 40200805]

Fixed packages 25

ReleasePackageFixed in
Oracle Linux · 7 php 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-bcmath 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-cli 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-common 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-dba 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-devel 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-embedded 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-enchant 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-fpm 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-gd 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-intl 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-ldap 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-mbstring 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-mysql 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-mysqlnd 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-odbc 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-pdo 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-pgsql 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-process 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-pspell 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-recode 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-snmp 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-soap 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-xml 0:5.4.16-48.0.1.el7
Oracle Linux · 7 php-xmlrpc 0:5.4.16-48.0.1.el7

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-109619 Exploited Public exploit Scanner template EPSS 100%

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026