Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2026:88693 1 CVE

Red Hat Security Advisory: php security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 7 ELS rhel_els:7 php 0:5.4.16-48.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7 php-cli 0:5.4.16-48.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7 php-embedded 0:5.4.16-48.el7_9.1
Red Hat · RHEL 7 ELS rhel_els:7 php-fpm 0:5.4.16-48.el7_9.1

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-109619 Exploited Public exploit Scanner template EPSS 100%

    RCE via stale global state

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
    KEV Oct 26, 2026

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2554177
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88693.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-109619
  • article
    https://access.redhat.com/security/vulnerabilities/RHSB-2026-013
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-109619
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-109619
  • article
    https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog