したがって、ALAS2023-2026-1726 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    PHP: リモートサーバーでの TLS 設定に失敗すると、リモート DoS が発生する可能性があります (CVE-2026-12184)

    攻撃者が指定したエンコーディングによる mb_convert_encoding() でのグローバルバッファオーバーリード (CVE-2026-6104)

    8.2.31 より前の 8.2.*、8.3.31 より前の 8.3.*、8.4.21 より前の 8.4.*、8.5.6 より前の 8.5.* の PHP バージョンでは、SOAP 拡張のオブジェクト重複排除メカニズムが、参照カウントを増加せずに、グローバルマップ内の PHP オブジェクトへのポインターを保存します。apache:Map ノードに重複するキーが含まれている場合、2 番目のエントリを処理すると、一時結果マップの 1 番目のエントリが上書きされ、古いポインターがマップに残っている間、元の PHP オブジェクトが解放されます。解放されたノードへの後続の href 参照により、ダングリングポインターを結果にコピーできます。PHP 文字列割り当てが解放されたメモリ領域を再利用できるため、SOAP リクエスト本文をコントロールできる攻撃者がこの use-after-free を悪用して、リモートコードを実行する可能性があります。
    (CVE-2026-6722)

    8.2.31 より前の 8.2.*、8.3.31 より前の 8.3.*、8.4.21 より前の 8.4.*、8.5.6 より前の 8.5.* の PHP バージョンでは、ユーザーデータの不適切なサニタイズにより、ターゲットが PHP-FPM ステータスページを表示しているときにターゲットのマシンでターゲットに任意の JavaScript コード (XSS) を実行させる URL を攻撃者が作成できます。(CVE-2026-6735)

    urldecode() における領域外読み取り (CVE-2026-7258)

    mb_ereg_search_init() による php_mb_check_encoding() での NULL ポインターデリファレンス (CVE-2026-7259)

    8.2.31 より前の 8.2.*、8.3.31 より前の 8.3.*、8.4.21 より前の 8.4.*、8.5.6 より前の 8.5.* の PHP バージョンで、SoapServer が SOAP_PERSISTENCE_SESSION で構成されている場合、ハンドラーオブジェクトはセッションストレージを介してリクエスト間で永続化されます。ただし、SOAP リクエストがエラーをもたらす場合、永続化が不適切に処理されるため、オブジェクトへのポインターを保持したままオブジェクトが解放され、use-after-free につながる可能性があります。これにより、メモリの破損、情報漏洩、プロセスのクラッシュが発生する可能性があり、脆弱なシステムでは機密性、整合性、可用性に影響を及ぼします。(CVE-2026-7261)

    <value> が欠如している SOAP apache:Map デコーダーの NULL ポインターデリファレンス (CVE-2026-7262)

    DOMNode::C14N() による DoS 攻撃。DOMNode::C14N() で、二重リンクリストからの xmlns libxml2 属性の不適切な削除は、破損した循環リンクリストにつながる可能性があります。そのようなリンクリストは、PHP と libxml2 の多くの場所で繰り返され、セグメンテーション違反、または時間的および空間的なリソース枯渇による DoS につながります。
    (CVE-2026-7263)

    metaphone() の符号付き整数オーバーフロー (CVE-2026-7568)

Tenable は、前述の記述ブロックをテスト済み製品のセキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Debian 13 ホストには、dsa-6256 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    - ------------------------------------------------------------------------- Debian セキュリティアドバイザリ DSA-6256-1 security@debian.org https://www.debian.org/security/Moritz Muehlenhoff 2026 年 5 月 8 日 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    パッケージ : php8.4 CVE ID : CVE-2025-14179 CVE-2026-6104 CVE-2026-6722 CVE-2026-6735 CVE-2026-7258 CVE-2026-7259 CVE-2026-7261 CVE-2026-7262 CVE-2026-7263 CVE-2026-7568

    広く使用されているオープンソース汎用スクリプト言語である PHP に、サービス拒否、SQL インジェクション、クロスサイトスクリプティング、情報漏洩、または任意コード実行を引き起こす可能性がある、複数のセキュリティの問題が見つかりました。

    安定版 (stable) ディストリビューション (trixie) では、これらの問題はバージョン 8.4.21-1~deb13u1 で修正されています。

    お使いの php8.4 パッケージをアップグレードすることを推奨します。

    php8.4 の詳細なセキュリティステータスについては、そのセキュリティトラッカーページを参照してください。
    https://security-tracker.debian.org/tracker/php8.4

    Debian セキュリティアドバイザリに関する詳細、これらの更新をシステムに適用する方法、およびよくある質問については、こちらを参照してください。https://www.debian.org/security/

    メーリングリスト: debian-security-announce@lists.debian.org

前述の説明ブロックは、Tenable が Debian セキュリティアドバイザリから直接抽出したものです。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Fedora 43 ホストには、FEDORA-2026-c4d1ca4f16 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    **PHP バージョン 8.4.21** (2026 年 5 月 7 日)

    **Core:**

    * バグ [GH-19983](https://github.com/php/php-src/issues/19983) (ファイバー、ジェネレーター、デストラクターによる GC アサーションエラー) を修正しました。(iliaal)
    * バグ [GH-21478](https://github.com/php/php-src/issues/21478) (初期化された遅延プロキシに対して、プロパティ操作を実インスタンスに転送する) を修正しました。(iliaal)
    * バグ [GH-21605](https://github.com/php/php-src/issues/21605) (Countable::count() の addref がない) を修正しました。(ilutov)
    * バグ [GH-21699](https://github.com/php/php-src/issues/21699) (エラーハンドラーがスローされる場合の、self::/parent::/static:: callables を解決するときの shutdown_executor でのアサーション失敗) を修正しました。
    (macoaure)
    * バグ [GH-21603](https://github.com/php/php-src/issues/21603) (__unset の addref がない) を修正しました。(ilutov)
    * バグ [GH-21760](https://github.com/php/php-src/issues/21760)(クラス定数名を持つトレイトが enum のケースと競合すると SEGV が発生) を修正しました。(Pratik Bhujel)

    **CLI:**

    * バグ [GH-21754](https://github.com/php/php-src/issues/21754) (メソッドを伴う「--rf」コマンドラインオプションが ext/reflection 廃止警告をトリガーする) を修正しました。(DanielEScherzer)

    **Curl:**

    * Windows で brotli および zstd のサポートを追加します。(Shivam Mathur)

    **DOM:**

    * [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) および [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() が setAttributeNS() の後に重複する xmlns 宣言を出力) を修正しました。(**CVE-2026-7263**) (David Carlier)
    * バグ [GH-21688](https://github.com/php/php-src/issues/21688) (空の HTMLDocument のセグメンテーション違反) を修正しました。(David Carlier 氏)
    * lexbor v2.7.0 にアップグレードしてください。(**CVE-2026-29078**、**CVE-2026-29079**) (ndossche、ilutov)

    **FPM:**

    * [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (ステータスエンドポイント内の XSS) を修正しました。(**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * バグ [GH-17399](https://github.com/php/php-src/issues/17399) (救済における iconv のメモリリーク) を修正しました。
    (iliaal)

    **MBString:**

    * [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75) (mb_ereg_search_init() による php_mb_check_encoding() での NULL ポインターデリファレンス) を修正しました。(**CVE-2026-7259**) (vi3tL0u1s)
    * [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53) (mbfl_name2encoding_ex() での領域外アクセス) を修正しました。(**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * バグ [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: アサーション jit->ra[var].flags & (1<<0) が zend_jit_use_reg で失敗した) を修正しました。(Arnaud)
    * バグ [GH-21593](https://github.com/php/php-src/issues/21593) (Borked 関数 JIT JMPNZ スマートブランチ) を修正しました。(ilutov)
    * バグ [GH-21460](https://github.com/php/php-src/issues/21460) (COND 最適化回帰) を修正しました。
    (Dmitry、Arnaud)
    * zend_jit_trace() の zend_try ブロックからの誤ったリターンを修正しました。(ilutov)

    **OpenSSL:**

    * エッジケースでの多数のメモリリークとクラッシュを修正します。(ndossche)

    **PDO_Firebird:**

    * [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (引用符で囲まれた文字列の NULL バイトによる SQL インジェクション) を修正しました。(**CVE-2025-14179**) (SakiTakamachi)

    **Phar:**

    * phar_intercept_functions_shutdown で is_link ハンドラーを復元します。(iliaal)
    * バグ [GH-21797](https://github.com/php/php-src/issues/21797) (phar:SCRIPT_NAME が SAPI 環境にないときの Phar::webPhar() の NULL 逆参照) を修正しました。(iliaal)
    * Phar::offsetGet() でのメモリリークを修正します。(iliaal)
    * phar_add_file() でのメモリリークを修正します。(iliaal)
    * バグ [GH-21799](https://github.com/php/php-src/issues/21799) (phar: phar_stream_close から phar_stream_flush の戻り値を伝播) を修正しました。(iliaal)
    * md_ctx が無効な場合の phar_verify_signature() でのメモリリークを修正します。(JarneClauw)

    **Random:**

    * バグ [GH-21731](https://github.com/php/php-src/issues/21731) (Random\Engine\Xoshiro256StarStar::__unserialize() はすべてゼロ状態を受け入れる) を修正しました。(iliaal)

    **Session:**

    * セッション GC コールバックが refcounted 値を返す際のメモリリークを修正しました。(jorgsowa)

    **SOAP:**

    * [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5) (Apache Map を伴う古い SOAP_GLOBAL(ref_map) ポインター) を修正しました。(**CVE-2026-6722**) (ilutov)
    * [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q) (SOAP_PERSISTENCE_SESSION によるヘッダー解析失敗後の use-after-free) を修正しました。(**CVE-2026-7261**) (ilutov)
    * [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv) (壊れた Apache マップ値の NULL チェック) を修正しました。(**CVE-2026-7262**) (ilutov)

    **SPL：**

    * バグ [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator の親解放後の getChildren UAF) を修正しました。(Girgios 氏)
    * SplObjectStorage の同時反復と削除の問題を修正します。(ndossche)

    **Standard:**

    * [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57) (char 配列オフセットの符号付き整数オーバーフロー) を修正しました。(**CVE-2026-7568**) (TimWolla)
    * [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4) (符号なし char を ctype.h 関数に一貫して渡す) を修正しました。(**CVE-2026-7258**) (ilutov)

    **Streams:**

    * バグ [GH-21468](https://github.com/php/php-src/issues/21468) (https URL およびプロキシセットによる file_get_contents のセグメンテーション違反) を修正。(ndossche)

    **XSL:**

    * バグ [GH-21600](https://github.com/php/php-src/issues/21600) (モジュールシャットダウンのセグメンテーション違反) を修正しました。(David Carlier 氏)

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS ホストには、USN-8336-1 アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    Aleksey Solovev 氏および Nikita Sveshnikov 氏は、PDO Firebird ドライバーで SQL クエリを準備する際に、PHP が NULL バイトを不適切に処理することを発見しました。攻撃者がこの問題を悪用して、SQL インジェクション攻撃を仕掛ける可能性があります。(CVE-2025-14179)

    mbstring において、PHP が特定のエンコーディング名を誤って処理することがわかりました。攻撃者はこの問題を利用して、機密情報を入手したり、サービス拒否を引き起こしたりする可能性があります。この問題の影響を受けるのは、Ubuntu 25.10 および Ubuntu 26.04 LTS のみです。(CVE-2026-6104)

    細工された SOAP リクエストを解析する際に、PHP がオブジェクト参照を不適切に処理していることが判明しました。リモートの攻撃者がこの問題を悪用して、任意のコードを実行する可能性があります。(CVE-2026-6722)

    PHP-FPM ステータスページの特定のデータを PHP が不適切にサニタイズしていることが判明しました。リモートの攻撃者がこの問題を利用して任意の JavaScript コードを挿入する可能性があります。(CVE-2026-6735)

    PHP の mbstring にエンコーディングの不一致があることがわかりました。攻撃者がこの問題を悪用して PHP をクラッシュさせ、サービス拒否を引き起こす可能性があります。(CVE-2026-7259)

    PHP がエラー後の SOAP セッションの永続性を不適切に処理することが判明しました。リモートの攻撃者がこの問題を利用して機密情報を入手したり、PHP をクラッシュさせてサービス拒否を引き起こしたりする可能性があります。(CVE-2026-7261)

    PHP が SOAP タイプマップのデコーディングで欠損値を不適切に処理することが判明しました。リモートの攻撃者がこの問題を悪用して、PHP をクラッシュさせ、サービス拒否を引き起こす可能性があります。(CVE-2026-7262)

    PHP が DOMNode::C14N() で XML 正規化を不適切に処理していることが判明しました。攻撃者がこの問題を悪用して、サービス拒否を引き起こす可能性があります。この問題の影響を受けるのは、Ubuntu 26.04 LTS のみです。
    (CVE-2026-7263)

    metaphone() 関数において、PHP が非常に長い入力を誤って処理することがわかりました。攻撃者がこの問題を悪用して PHP をクラッシュさせ、サービス拒否を引き起こす可能性があります。(CVE-2026-7568)

Tenable は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:22649 advisory.

    * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions     (CVE-2026-7258)
      * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)
      * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)
      * php: signed integer overflow in metaphone() (CVE-2026-7568)
      * php: denial of service via DOMNode::C14N() (CVE-2026-7263)
      * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a58db70ca advisory.

    **PHP version 8.4.21** (07 May 2026)

    **Core:**

    * Fixed bug [GH-19983](https://github.com/php/php-src/issues/19983) (GC assertion failure with fibers,     generators and destructors). (iliaal)
    * Fixed bug [GH-21478](https://github.com/php/php-src/issues/21478) (Forward property operations to real     instance for initialized lazy proxies). (iliaal)
    * Fixed bug [GH-21605](https://github.com/php/php-src/issues/21605) (Missing addref for     Countable::count()). (ilutov)
    * Fixed bug [GH-21699](https://github.com/php/php-src/issues/21699) (Assertion failure in     shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
    (macoaure)
    * Fixed bug [GH-21603](https://github.com/php/php-src/issues/21603) (Missing addref for __unset). (ilutov)
    * Fixed bug [GH-21760](https://github.com/php/php-src/issues/21760) (Trait with class constant name     conflict against enum case causes SEGV). (Pratik Bhujel)

    **CLI:**

    * Fixed bug [GH-21754](https://github.com/php/php-src/issues/21754) (`--rf` command line option with a     method triggers ext/reflection deprecation warnings). (DanielEScherzer)

    **Curl:**

    * Add support for brotli and zstd on Windows. (Shivam Mathur)

    **DOM:**

    * Fixed [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) and     [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() emits duplicate xmlns     declarations after setAttributeNS()). (**CVE-2026-7263**) (David Carlier)
    * Fixed bug [GH-21688](https://github.com/php/php-src/issues/21688) (segmentation fault on empty     HTMLDocument). (David Carlier)
    * Upgrade to lexbor v2.7.0. (**CVE-2026-29078**, **CVE-2026-29079**) (ndossche, ilutov)

    **FPM:**

    * Fixed [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (XSS     within status endpoint). (**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * Fixed bug [GH-17399](https://github.com/php/php-src/issues/17399) (iconv memory leak on bailout).
    (iliaal)

    **MBString:**

    * Fixed [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)     (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (**CVE-2026-7259**)     (vi3tL0u1s)
    * Fixed [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)     (Out-of-bounds access in mbfl_name2encoding_ex()). (**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * Fixed bug [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: Assertion jit->ra[var].flags &     (1<<0) failed in zend_jit_use_reg). (Arnaud)
    * Fixed bug [GH-21593](https://github.com/php/php-src/issues/21593) (Borked function JIT JMPNZ smart     branch). (ilutov)
    * Fixed bug [GH-21460](https://github.com/php/php-src/issues/21460) (COND optimization regression).
    (Dmitry, Arnaud)
    * Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    **OpenSSL:**

    * Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    **PDO_Firebird:**

    * Fixed [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (SQL     injection via NUL bytes in quoted strings). (**CVE-2025-14179**) (SakiTakamachi)

    **Phar:**

    * Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
    * Fixed bug [GH-21797](https://github.com/php/php-src/issues/21797) (phar: NULL dereference in     Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment). (iliaal)
    * Fix memory leak in Phar::offsetGet(). (iliaal)
    * Fix memory leak in phar_add_file(). (iliaal)
    * Fixed bug [GH-21799](https://github.com/php/php-src/issues/21799) (phar: propagate phar_stream_flush     return value from phar_stream_close). (iliaal)
    * Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    **Random:**

    * Fixed bug [GH-21731](https://github.com/php/php-src/issues/21731)     (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state). (iliaal)

    **Session:**

    * Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    **SOAP:**

    * Fixed [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)     (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (**CVE-2026-6722**) (ilutov)
    * Fixed [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)     (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (**CVE-2026-7261**) (ilutov)
    * Fixed [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)     (Broken Apache map value NULL check). (**CVE-2026-7262**) (ilutov)

    **SPL:**

    * Fixed bug [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator getChildren     UAF after parent free). (Girgias)
    * Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    **Standard:**

    * Fixed [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)     (Signed integer overflow of char array offset). (**CVE-2026-7568**) (TimWolla)
    * Fixed [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)     (Consistently pass unsigned char to ctype.h functions). (**CVE-2026-7258**) (ilutov)

    **Streams:**

    * Fixed bug [GH-21468](https://github.com/php/php-src/issues/21468) (Segfault in file_get_contents w/ a     https URL and a proxy set). (ndossche)

    **XSL:**

    * Fixed bug [GH-21600](https://github.com/php/php-src/issues/21600) (Segfault on module shutdown). (David     Carlier)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1726 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a     doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places     in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
    (CVE-2026-7263)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22649 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write     dynamically generated web pages. PHP also offers built-in database integration for several commercial and     non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly     simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

    Security Fix(es):

    * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions     (CVE-2026-7258)

    * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

    * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    * php: signed integer overflow in metaphone() (CVE-2026-7568)

    * php: denial of service via DOMNode::C14N() (CVE-2026-7263)

    * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.6 advisory.

  - uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.4.21. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.21 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21612-1 advisory.

    This update for php8 fixes the following issues

    - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries     can lead to SQL       injection (bsc#1264778).
    - CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in       `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777).
    - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
    - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS     (bsc#1264775).
    - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access     and denial of       service (bsc#1264774).
    - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can     lead to a denial       of service (bsc#1264773).
    - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when     SOAP_PERSISTENCE_SESSION       is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
    - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is     configured       can lead to a denial of service (bsc#1264771).
    - CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite     loop and a       denial of service (bsc#1264770).
    - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect     the availability       of the PHPprocess (bsc#1264769).

    Other updates:

    - Updated to 8.4.21.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22649 advisory.

    * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions     (CVE-2026-7258)

    * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

    * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    * php: signed integer overflow in metaphone() (CVE-2026-7568)

    * php: denial of service via DOMNode::C14N() (CVE-2026-7263)

    * php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c66eaae759 advisory.

    **PHP version 8.5.6** (07 May 2026)

    **Core:**

    * Fixed bug [GH-19983](https://github.com/php/php-src/issues/19983) (GC assertion failure with fibers,     generators and destructors). (iliaal)
    * Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang. (henderkes)
    * Fixed bug [GH-21504](https://github.com/php/php-src/issues/21504) (Incorrect RC-handling for     ZEND_EXT_STMT op1). (ilutov)
    * Fixed bug [GH-21478](https://github.com/php/php-src/issues/21478) (Forward property operations to real     instance for initialized lazy proxies). (iliaal)
    * Fixed bug [GH-21605](https://github.com/php/php-src/issues/21605) (Missing addref for     Countable::count()). (ilutov)
    * Fixed bug [GH-21699](https://github.com/php/php-src/issues/21699) (Assertion failure in     shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
    (macoaure)
    * Fixed bug [GH-21603](https://github.com/php/php-src/issues/21603) (Missing addref for __unset). (ilutov)
    * Fixed bug [GH-21760](https://github.com/php/php-src/issues/21760) (Trait with class constant name     conflict against enum case causes SEGV). (Pratik Bhujel)

    **CLI:**

    * Fixed bug [GH-21754](https://github.com/php/php-src/issues/21754) (`--rf` command line option with a     method triggers ext/reflection deprecation warnings). (DanielEScherzer)

    **Curl:**

    * Add support for brotli and zstd on Windows. (Shivam Mathur)

    **DOM:**

    * Fixed [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) and     [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() emits duplicate xmlns     declarations after setAttributeNS()). (**CVE-2026-7263**) (David Carlier)

    **FPM:**

    * Fixed [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (XSS     within status endpoint). (**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * Fixed bug [GH-17399](https://github.com/php/php-src/issues/17399) (iconv memory leak on bailout).
    (iliaal)

    **Lexbor:**

    * Upgrade to lexbor v2.7.0. (**CVE-2026-29078**, **CVE-2026-29079**) (ndossche, ilutov)

    **MBString:**

    * Fixed [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)     (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (**CVE-2026-7259**)     (vi3tL0u1s)
    * Fixed [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)     (Out-of-bounds access in mbfl_name2encoding_ex()). (**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * Fixed bug [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: Assertion jit->ra[var].flags &     (1<<0) failed in zend_jit_use_reg). (Arnaud)
    * Fixed bug [GH-21593](https://github.com/php/php-src/issues/21593) (Borked function JIT JMPNZ smart     branch). (ilutov)
    * Fixed bug [GH-21460](https://github.com/php/php-src/issues/21460) (COND optimization regression).
    (Dmitry, Arnaud)
    * Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    **OpenSSL:**

    * Fix memory leak regression in openssl_pbkdf2(). (ndossche)
    * Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    **PDO_Firebird:**

    * Fixed [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (SQL     injection via NUL bytes in quoted strings). (**CVE-2025-14179**) (SakiTakamachi)

    **PDO_PGSQL:**

    * Fixed bug [GH-21683](https://github.com/php/php-src/issues/21683) (pdo_pgsql throws with ATTR_PREFETCH=0     on empty result set). (thomasschiet)

    **Phar:**

    * Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
    * Fixed bug [GH-21797](https://github.com/php/php-src/issues/21797) (phar: NULL dereference in     Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment). (iliaal)
    * Fix memory leak in Phar::offsetGet(). (iliaal)
    * Fix memory leak in phar_add_file(). (iliaal)
    * Fixed bug [GH-21799](https://github.com/php/php-src/issues/21799) (phar: propagate phar_stream_flush     return value from phar_stream_close). (iliaal)
    * Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    **Random:**

    * Fixed bug [GH-21731](https://github.com/php/php-src/issues/21731)     (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state). (iliaal)

    **Session:**

    * Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    **SOAP:**

    * Fixed [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)     (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (**CVE-2026-6722**) (ilutov)
    * Fixed [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)     (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (**CVE-2026-7261**) (ilutov)
    * Fixed [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)     (Broken Apache map value NULL check). (**CVE-2026-7262**) (ilutov)

    **SPL:**

    * Fixed bug [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator getChildren     UAF after parent free). (Girgias)
    * Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    **Sqlite3:**

    * Fixed wrong free list comparator pointer type. (David Carlier)

    **Standard:**

    * Fixed [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)     (Signed integer overflow of char array offset). (**CVE-2026-7568**) (TimWolla)
    * Fixed [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)     (Consistently pass unsigned char to ctype.h functions). (**CVE-2026-7258**) (ilutov)

    **Streams:**

    * Fixed bug [GH-21468](https://github.com/php/php-src/issues/21468) (Segfault in file_get_contents w/ a     https URL and a proxy set). (ndossche)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22649 advisory.

    [8.4.21-2]
    - rebase to 8.4.21

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is between 6.6.0 and 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-19 advisory.

  - Tenable Security Center is affected by a SQL injection vulnerability. (CVE-2026-64877)

  - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue     affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the     issue. (CVE-2026-23918)

  - Stack buffer overflow in PostgreSQL module refint allows an unprivileged database user to execute     arbitrary code as the operating system user running the database. A distinct attack is possible if the     application declares a user-controlled column as a refint cascade primary key and facilitates user-     controlled updates to that column. In that case, a SQL injection allows a primary key update value     provider to execute arbitrary SQL as the database user performing the primary key update. Versions before     PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected. (CVE-2026-6637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6256 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6256-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 08, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php8.4     CVE ID         : CVE-2025-14179 CVE-2026-6104 CVE-2026-6722 CVE-2026-6735                      CVE-2026-7258 CVE-2026-7259 CVE-2026-7261 CVE-2026-7262                      CVE-2026-7263 CVE-2026-7568

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language which could result in denial of     service, SQL injection, cross-site scripting, information disclosure     or the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 8.4.21-1~deb13u1.

    We recommend that you upgrade your php8.4 packages.

    For the detailed security status of php8.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.4

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c4d1ca4f16 advisory.

    **PHP version 8.4.21** (07 May 2026)

    **Core:**

    * Fixed bug [GH-19983](https://github.com/php/php-src/issues/19983) (GC assertion failure with fibers,     generators and destructors). (iliaal)
    * Fixed bug [GH-21478](https://github.com/php/php-src/issues/21478) (Forward property operations to real     instance for initialized lazy proxies). (iliaal)
    * Fixed bug [GH-21605](https://github.com/php/php-src/issues/21605) (Missing addref for     Countable::count()). (ilutov)
    * Fixed bug [GH-21699](https://github.com/php/php-src/issues/21699) (Assertion failure in     shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
    (macoaure)
    * Fixed bug [GH-21603](https://github.com/php/php-src/issues/21603) (Missing addref for __unset). (ilutov)
    * Fixed bug [GH-21760](https://github.com/php/php-src/issues/21760) (Trait with class constant name     conflict against enum case causes SEGV). (Pratik Bhujel)

    **CLI:**

    * Fixed bug [GH-21754](https://github.com/php/php-src/issues/21754) (`--rf` command line option with a     method triggers ext/reflection deprecation warnings). (DanielEScherzer)

    **Curl:**

    * Add support for brotli and zstd on Windows. (Shivam Mathur)

    **DOM:**

    * Fixed [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) and     [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() emits duplicate xmlns     declarations after setAttributeNS()). (**CVE-2026-7263**) (David Carlier)
    * Fixed bug [GH-21688](https://github.com/php/php-src/issues/21688) (segmentation fault on empty     HTMLDocument). (David Carlier)
    * Upgrade to lexbor v2.7.0. (**CVE-2026-29078**, **CVE-2026-29079**) (ndossche, ilutov)

    **FPM:**

    * Fixed [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (XSS     within status endpoint). (**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * Fixed bug [GH-17399](https://github.com/php/php-src/issues/17399) (iconv memory leak on bailout).
    (iliaal)

    **MBString:**

    * Fixed [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)     (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (**CVE-2026-7259**)     (vi3tL0u1s)
    * Fixed [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)     (Out-of-bounds access in mbfl_name2encoding_ex()). (**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * Fixed bug [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: Assertion jit->ra[var].flags &     (1<<0) failed in zend_jit_use_reg). (Arnaud)
    * Fixed bug [GH-21593](https://github.com/php/php-src/issues/21593) (Borked function JIT JMPNZ smart     branch). (ilutov)
    * Fixed bug [GH-21460](https://github.com/php/php-src/issues/21460) (COND optimization regression).
    (Dmitry, Arnaud)
    * Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    **OpenSSL:**

    * Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    **PDO_Firebird:**

    * Fixed [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (SQL     injection via NUL bytes in quoted strings). (**CVE-2025-14179**) (SakiTakamachi)

    **Phar:**

    * Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
    * Fixed bug [GH-21797](https://github.com/php/php-src/issues/21797) (phar: NULL dereference in     Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment). (iliaal)
    * Fix memory leak in Phar::offsetGet(). (iliaal)
    * Fix memory leak in phar_add_file(). (iliaal)
    * Fixed bug [GH-21799](https://github.com/php/php-src/issues/21799) (phar: propagate phar_stream_flush     return value from phar_stream_close). (iliaal)
    * Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    **Random:**

    * Fixed bug [GH-21731](https://github.com/php/php-src/issues/21731)     (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state). (iliaal)

    **Session:**

    * Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    **SOAP:**

    * Fixed [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)     (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (**CVE-2026-6722**) (ilutov)
    * Fixed [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)     (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (**CVE-2026-7261**) (ilutov)
    * Fixed [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)     (Broken Apache map value NULL check). (**CVE-2026-7262**) (ilutov)

    **SPL:**

    * Fixed bug [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator getChildren     UAF after parent free). (Girgias)
    * Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    **Standard:**

    * Fixed [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)     (Signed integer overflow of char array offset). (**CVE-2026-7568**) (TimWolla)
    * Fixed [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)     (Consistently pass unsigned char to ctype.h functions). (**CVE-2026-7258**) (ilutov)

    **Streams:**

    * Fixed bug [GH-21468](https://github.com/php/php-src/issues/21468) (Segfault in file_get_contents w/ a     https URL and a proxy set). (ndossche)

    **XSL:**

    * Fixed bug [GH-21600](https://github.com/php/php-src/issues/21600) (Segfault on module shutdown). (David     Carlier)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8336-1 advisory.

    Aleksey Solovev and Nikita Sveshnikov discovered that PHP improperly handled NUL bytes when preparing SQL     queries in the PDO Firebird driver. An attacker could possibly use this issue to perform SQL injection     attacks. (CVE-2025-14179)

    It was discovered that PHP incorrectly handled certain encoding names in mbstring. An attacker could     possibly use this issue to obtain sensitive information or cause a denial of service. This issue only     affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-6104)

    It was discovered that PHP incorrectly handled object references while parsing crafted SOAP requests. A     remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-6722)

    It was discovered that PHP incorrectly sanitized certain data in the PHP-FPM status page. A remote     attacker could possibly use this issue to inject arbitrary JavaScript code. (CVE-2026-6735)

    It was discovered that PHP had an encoding mismatch in mbstring. An attacker could possibly use this issue     to cause PHP to crash, resulting in a denial of service. (CVE-2026-7259)

    It was discovered that PHP incorrectly handled SOAP session persistence after errors. A remote attacker     could possibly use this issue to obtain sensitive information or cause PHP to crash, resulting in a denial     of service. (CVE-2026-7261)

    It was discovered that PHP incorrectly handled missing values in SOAP typemap decoding. A remote attacker     could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7262)

    It was discovered that PHP incorrectly handled XML canonicalization in DOMNode::C14N(). An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-7263)

    It was discovered that PHP incorrectly handled very long input in metaphone(). An attacker could possibly     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
316837	Amazon Linux 2023 : php8.4、php8.4-bcmath、php8.4-cli (ALAS2023-2026-1726)	Nessus	Amazon Linux Local Security Checks	2026/5/26	2026/7/16	critical
313417	Debian dsa-6256 : libapache2-mod-php8.4 - セキュリティ更新	Nessus	Debian Local Security Checks	2026/5/8	2026/5/15	critical
315615	Fedora 43 : php (2026-c4d1ca4f16)	Nessus	Fedora Local Security Checks	2026/5/20	2026/5/20	critical
318235	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : PHP の脆弱性 (USN-8336-1)	Nessus	Ubuntu Local Security Checks	2026/6/2	2026/6/2	critical
327065	AlmaLinux 10 : php8.4 (ALSA-2026:22649)	Nessus	Alma Linux Local Security Checks	2026/7/15	2026/7/15	high
314603	Fedora 42 : php (2026-3a58db70ca)	Nessus	Fedora Local Security Checks	2026/5/14	2026/5/15	critical
316837	Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-1726)	Nessus	Amazon Linux Local Security Checks	2026/5/26	2026/7/16	critical
319547	RHEL 10 : php8.4 (RHSA-2026:22649)	Nessus	Red Hat Local Security Checks	2026/6/6	2026/6/6	high
313112	PHP 8.5.x < 8.5.6 Multiple Vulnerabilities	Nessus	CGI abuses	2026/5/7	2026/5/15	critical
313115	PHP 8.4.x < 8.4.21 Multiple Vulnerabilities	Nessus	CGI abuses	2026/5/7	2026/5/15	critical
315067	SUSE SLES16 Security Update : php8 (SUSE-SU-2026:21612-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/16	critical
318821	RockyLinux 10 : php8.4 (RLSA-2026:22649)	Nessus	Rocky Linux Local Security Checks	2026/6/5	2026/6/5	high
313734	Fedora 44 : php (2026-c66eaae759)	Nessus	Fedora Local Security Checks	2026/5/10	2026/5/15	critical
328015	Oracle Linux 10 : php8.4 (ELSA-2026-22649)	Nessus	Oracle Linux Local Security Checks	2026/7/20	2026/7/20	high
328966	Tenable Security Center Multiple Vulnerabilities (TNS-2026-19)	Nessus	Misc.	2026/7/22	2026/7/23	critical
313417	Debian dsa-6256 : libapache2-mod-php8.4 - security update	Nessus	Debian Local Security Checks	2026/5/8	2026/5/15	critical
315615	Fedora 43 : php (2026-c4d1ca4f16)	Nessus	Fedora Local Security Checks	2026/5/20	2026/5/20	critical
318235	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : PHP vulnerabilities (USN-8336-1)	Nessus	Ubuntu Local Security Checks	2026/6/2	2026/6/2	critical

检测

插件搜索

critical

critical

critical

critical

high

critical

critical

high

critical

critical

critical

high

critical

high

critical

critical

critical

critical