Linux · Security advisory · June 2, 2026

ALSA-2026:22649: Security update for 25 packages

ALSA-2026:22649, released June 2, 2026, fixes 8 CVEs across 25 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
8
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0089
59th percentile

Priority of the 8 CVEs

Patch now 0 Urgent 1 High 7 Routine 0

Fixed package versions

ProductReleaseFixed in
php8.4almalinux 108.4.21-1.el10_2
php8.4-bcmathalmalinux 108.4.21-1.el10_2
php8.4-clialmalinux 108.4.21-1.el10_2
php8.4-commonalmalinux 108.4.21-1.el10_2
php8.4-dbaalmalinux 108.4.21-1.el10_2
php8.4-dbgalmalinux 108.4.21-1.el10_2
php8.4-develalmalinux 108.4.21-1.el10_2
php8.4-embeddedalmalinux 108.4.21-1.el10_2
php8.4-enchantalmalinux 108.4.21-1.el10_2
php8.4-ffialmalinux 108.4.21-1.el10_2
php8.4-fpmalmalinux 108.4.21-1.el10_2
php8.4-gdalmalinux 108.4.21-1.el10_2
php8.4-gmpalmalinux 108.4.21-1.el10_2
php8.4-intlalmalinux 108.4.21-1.el10_2
php8.4-ldapalmalinux 108.4.21-1.el10_2
php8.4-mbstringalmalinux 108.4.21-1.el10_2
php8.4-mysqlndalmalinux 108.4.21-1.el10_2
php8.4-odbcalmalinux 108.4.21-1.el10_2
php8.4-opcachealmalinux 108.4.21-1.el10_2
php8.4-pdoalmalinux 108.4.21-1.el10_2
php8.4-pgsqlalmalinux 108.4.21-1.el10_2
php8.4-processalmalinux 108.4.21-1.el10_2
php8.4-snmpalmalinux 108.4.21-1.el10_2
php8.4-soapalmalinux 108.4.21-1.el10_2
php8.4-xmlalmalinux 108.4.21-1.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Urgent CVE-2026-6104 php8.4: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is... 9.1 0.0047 None reported
High CVE-2026-6722 php-pecl-xdebug3: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP:... 9.8 0.0089 None reported
High CVE-2026-7262 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server 8.2 0.0078 None reported
High CVE-2026-7568 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server 8.2 0.0046 None reported
High CVE-2026-7258 Out-of-bounds read in urldecode() on NetBSD 8.2 0.0036 None reported
High CVE-2026-7263 php8.4: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrect... 8.2 0.0035 None reported
High CVE-2026-7261 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP:... 9.8 0.0030 None reported
High CVE-2026-6735 XSS within PHP-FPM status endpoint 8.2 0.0019 None reported
Showing 1 to 8 of 8 1