The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8336-1 advisory.

    Aleksey Solovev and Nikita Sveshnikov discovered that PHP improperly handled NUL bytes when preparing SQL     queries in the PDO Firebird driver. An attacker could possibly use this issue to perform SQL injection     attacks. (CVE-2025-14179)

    It was discovered that PHP incorrectly handled certain encoding names in mbstring. An attacker could     possibly use this issue to obtain sensitive information or cause a denial of service. This issue only     affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-6104)

    It was discovered that PHP incorrectly handled object references while parsing crafted SOAP requests. A     remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-6722)

    It was discovered that PHP incorrectly sanitized certain data in the PHP-FPM status page. A remote     attacker could possibly use this issue to inject arbitrary JavaScript code. (CVE-2026-6735)

    It was discovered that PHP had an encoding mismatch in mbstring. An attacker could possibly use this issue     to cause PHP to crash, resulting in a denial of service. (CVE-2026-7259)

    It was discovered that PHP incorrectly handled SOAP session persistence after errors. A remote attacker     could possibly use this issue to obtain sensitive information or cause PHP to crash, resulting in a denial     of service. (CVE-2026-7261)

    It was discovered that PHP incorrectly handled missing values in SOAP typemap decoding. A remote attacker     could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7262)

    It was discovered that PHP incorrectly handled XML canonicalization in DOMNode::C14N(). An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-7263)

    It was discovered that PHP incorrectly handled very long input in metaphone(). An attacker could possibly     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:33449 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: php-soap: php-src: PHP SOAP extension: Remote Code Execution via use-after-free vulnerability     (CVE-2026-6722)

    * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions     (CVE-2026-7258)

    * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

    * PHP: PHP SoapServer: Memory corruption and information disclosure via incorrect persistence handling     (CVE-2026-7261)

    * php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    * php: NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    * php: signed integer overflow in metaphone() (CVE-2026-7568)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1728 advisory.

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.2.31-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2026-011 advisory.

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
318235	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : PHP vulnerabilities (USN-8336-1)	Nessus	Ubuntu Local Security Checks	2026/6/2	2026/6/2	critical
323976	RHEL 9 : php (RHSA-2026:33449)	Nessus	Red Hat Local Security Checks	2026/6/30	2026/6/30	critical
316980	Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1728)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	critical
317028	Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-011 (ALASPHP8.2-2026-011)	Nessus	Amazon Linux Local Security Checks	2026/5/27	2026/5/27	critical

检测

插件搜索

critical

critical

critical

critical