# ALSA-2026:22143: Security update for 6 packages

ALSA-2026:22143, released June 1, 2026, fixes 6 CVEs across 6 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alsa-2026-22143
- Platform: Linux
- Released: Jun 1, 2026
- Priority: High (Closes CVE-2026-6722, high severity)
- CVEs: 6, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:22143

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [apcu-panel](https://patchblox.com/security/data/product/linux/apcu-panel.md) | almalinux 9 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| [php-pecl-apcu](https://patchblox.com/security/data/product/linux/php-pecl-apcu.md) | almalinux 9 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| [php-pecl-apcu-devel](https://patchblox.com/security/data/product/linux/php-pecl-apcu-devel.md) | almalinux 9 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| [php-pecl-rrd](https://patchblox.com/security/data/product/linux/php-pecl-rrd.md) | almalinux 9 | 2.0.3-4.module_el9.4.0+65+49ff6472 |
| [php-pecl-xdebug3](https://patchblox.com/security/data/product/linux/php-pecl-xdebug3.md) | almalinux 9 | 3.2.2-2.module_el9.4.0+65+49ff6472 |
| [php-pecl-zip](https://patchblox.com/security/data/product/linux/php-pecl-zip.md) | almalinux 9 | 1.22.3-1.module_el9.4.0+65+49ff6472 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-6722](https://patchblox.com/security/data/cve/CVE-2026-6722.md) | High | php-pecl-xdebug3: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  Security Fix(es):  * PHP: PHP:... | 9.8 | 0.0089 |  |
| [CVE-2026-7262](https://patchblox.com/security/data/cve/CVE-2026-7262.md) | High | apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server | 8.2 | 0.0078 |  |
| [CVE-2026-7568](https://patchblox.com/security/data/cve/CVE-2026-7568.md) | High | apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server | 8.2 | 0.0046 |  |
| [CVE-2026-7258](https://patchblox.com/security/data/cve/CVE-2026-7258.md) | High | Out-of-bounds read in urldecode() on NetBSD | 8.2 | 0.0036 |  |
| [CVE-2026-7261](https://patchblox.com/security/data/cve/CVE-2026-7261.md) | High | apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.  Security Fix(es):  * PHP: PHP:... | 9.8 | 0.0030 |  |
| [CVE-2026-6735](https://patchblox.com/security/data/cve/CVE-2026-6735.md) | High | XSS within PHP-FPM status endpoint | 8.2 | 0.0019 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo