RHSA-2026:61903: Important: php:8.2 security, bug fix, and enhancement update
Important: php:8.2 security, bug fix, and enhancement update
Other sources
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.Security Fix(es): php: ext-pgsql: PHP: SQL injection via improper backslash escaping (CVE-2026-17543) php: PHP: Denial of Service via circular symbolic links in phar archives (CVE-2026-7260) Bug Fix(es) and Enhancement(s): Rebase PHP to 8.2.33 for CVE-2026-17543 and CVE-2026-7260 in 9.8.z (JIRA:RHEL-223942) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-pecl-apcuto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-rrdto a version that resolves this vulnerability.Fixed in 2.0.3-4.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-xdebug3to a version that resolves this vulnerability.Fixed in 3.2.2-2.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-zipto a version that resolves this vulnerability.Fixed in 1.22.3-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/apcu-panelto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-bcmathto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-bcmath-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-clito a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-cli-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-commonto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-common-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-dbato a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-dba-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-dbgto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-dbg-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-debugsourceto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-develto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-embeddedto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-embedded-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-enchantto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-enchant-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-ffito a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-ffi-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-fpmto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-fpm-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-gdto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-gd-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-gmpto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-gmp-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-intlto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-intl-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-ldapto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-ldap-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-mbstringto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-mbstring-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-mysqlndto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-mysqlnd-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-odbcto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-odbc-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-opcacheto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-opcache-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-pdoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-pdo-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-pecl-apcu-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-apcu-debugsourceto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-apcu-develto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-rrd-debuginfoto a version that resolves this vulnerability.Fixed in 2.0.3-4.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-rrd-debugsourceto a version that resolves this vulnerability.Fixed in 2.0.3-4.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-xdebug3-debuginfoto a version that resolves this vulnerability.Fixed in 3.2.2-2.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-xdebug3-debugsourceto a version that resolves this vulnerability.Fixed in 3.2.2-2.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-zip-debuginfoto a version that resolves this vulnerability.Fixed in 1.22.3-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pecl-zip-debugsourceto a version that resolves this vulnerability.Fixed in 1.22.3-1.module+el9.7.0+24111+199d2cc4 - Upgrade
Upgrade
redhat/php-pgsqlto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-processto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-process-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-snmpto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-snmp-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-soapto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-soap-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-xmlto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/php-xml-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-bcmathto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-bcmath-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-clito a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-cli-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-commonto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-common-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-dbato a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-dba-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-dbgto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-dbg-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-debugsourceto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-develto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-embeddedto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-embedded-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-enchantto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-enchant-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-ffito a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-ffi-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-fpmto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-fpm-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-gdto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-gd-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-gmpto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-gmp-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-intlto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-intl-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-ldapto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-ldap-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-mbstringto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-mbstring-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-mysqlndto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-mysqlnd-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-odbcto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-odbc-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-opcacheto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-opcache-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-pdoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-pdo-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-pecl-apcuto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-apcu-debuginfoto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-apcu-debugsourceto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-apcu-develto a version that resolves this vulnerability.Fixed in 5.1.23-1.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-rrdto a version that resolves this vulnerability.Fixed in 2.0.3-4.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-rrd-debuginfoto a version that resolves this vulnerability.Fixed in 2.0.3-4.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-rrd-debugsourceto a version that resolves this vulnerability.Fixed in 2.0.3-4.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-xdebug3to a version that resolves this vulnerability.Fixed in 3.2.2-2.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-xdebug3-debuginfoto a version that resolves this vulnerability.Fixed in 3.2.2-2.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-xdebug3-debugsourceto a version that resolves this vulnerability.Fixed in 3.2.2-2.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-zipto a version that resolves this vulnerability.Fixed in 1.22.3-1.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-zip-debuginfoto a version that resolves this vulnerability.Fixed in 1.22.3-1.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pecl-zip-debugsourceto a version that resolves this vulnerability.Fixed in 1.22.3-1.module+el9.7.0+24111+199d2cc4.aa - Upgrade
Upgrade
redhat/php-pgsqlto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-pgsql-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-processto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-process-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-snmpto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-snmp-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-soapto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-soap-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-xmlto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
redhat/php-xml-debuginfoto a version that resolves this vulnerability.Fixed in 8.2.33-1.module+el9.8.0+24630+45254c6a.aa - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.2.33Patch JIRA:RHEL-223942
Event History
Frequently Asked Questions
Which PHP functionality is implicated by the security fixes?
The update addresses an SQL injection issue in the ext-pgsql extension caused by improper backslash escaping, and a denial-of-service issue involving circular symbolic links in phar archives.
What PHP version includes the listed fixes?
The advisory states that PHP was rebased to version 8.2.33 for CVE-2026-17543 and CVE-2026-7260 in 9.8.z.
Which installed packages should be included when assessing update coverage?
The advisory lists redhat/php, redhat/php-cli, redhat/php-bcmath, redhat/php-pecl-apcu, redhat/php-pecl-rrd, redhat/php-pecl-xdebug3, redhat/php-pecl-zip, and redhat/php-bcmath-debuginfo.