The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8336-1 advisory.

    Aleksey Solovev and Nikita Sveshnikov discovered that PHP improperly handled NUL bytes when preparing SQL     queries in the PDO Firebird driver. An attacker could possibly use this issue to perform SQL injection     attacks. (CVE-2025-14179)

    It was discovered that PHP incorrectly handled certain encoding names in mbstring. An attacker could     possibly use this issue to obtain sensitive information or cause a denial of service. This issue only     affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-6104)

    It was discovered that PHP incorrectly handled object references while parsing crafted SOAP requests. A     remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-6722)

    It was discovered that PHP incorrectly sanitized certain data in the PHP-FPM status page. A remote     attacker could possibly use this issue to inject arbitrary JavaScript code. (CVE-2026-6735)

    It was discovered that PHP had an encoding mismatch in mbstring. An attacker could possibly use this issue     to cause PHP to crash, resulting in a denial of service. (CVE-2026-7259)

    It was discovered that PHP incorrectly handled SOAP session persistence after errors. A remote attacker     could possibly use this issue to obtain sensitive information or cause PHP to crash, resulting in a denial     of service. (CVE-2026-7261)

    It was discovered that PHP incorrectly handled missing values in SOAP typemap decoding. A remote attacker     could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7262)

    It was discovered that PHP incorrectly handled XML canonicalization in DOMNode::C14N(). An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-7263)

    It was discovered that PHP incorrectly handled very long input in metaphone(). An attacker could possibly     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33449 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability     (CVE-2026-6722)

    * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions     (CVE-2026-7258)

    * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

    * PHP: PHP SoapServer: Memory corruption and information disclosure via incorrect persistence handling     (CVE-2026-7261)

    * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    * php: signed integer overflow in metaphone() (CVE-2026-7568)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0181 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-6722:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global mapwithout     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

    CVE-2026-6735:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, itallows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing thePHP-FPM     status page.

    CVE-2026-7258:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     some functions, including urldecode(), pass signed char to ctype functions (likeisxdigit()). On the     systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can     lead to accessing array with negative offset, whichcan trigger a denial of service.

    CVE-2026-7261:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system.

    CVE-2026-7262:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the     wrong variable in case of missing value element. This leads todereferences a NULL pointer, causing a     segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process,     resulting in denial of service.

    CVE-2026-7568:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position     within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow     occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation     fault or access to unrelated memory, and may affect the availability of the PHP process.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1217:01 advisory.

    * php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability     (CVE-2026-6722)
      * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions     (CVE-2026-7258)
      * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)
      * PHP: PHP SoapServer: Memory corruption and information disclosure via incorrect persistence handling     (CVE-2026-7261)
      * php: NULL pointer dereference in SOAP apache:Map decoder with missing  (CVE-2026-7262)
      * php: signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
318235	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : PHP vulnerabilities (USN-8336-1)	Nessus	Ubuntu Local Security Checks	2026/6/2	2026/6/2	critical
323976	RHEL 9 : php (RHSA-2026:33449)	Nessus	Red Hat Local Security Checks	2026/6/30	2026/6/30	critical
325922	Alibaba Cloud Linux 3 : 0181: php:7.4 (ALINUX3-SA-2026:0181)	Nessus	Alibaba Cloud Linux Local Security Checks	2026/7/9	2026/7/9	critical
325773	MiracleLinux 8 : php:7.4 (AXSA:2026-1217:01)	Nessus	Miracle Linux Local Security Checks	2026/7/9	2026/7/13	critical

检测

插件搜索

critical

critical

critical

critical