Linux · Security advisory · July 17, 2026
ELSA-2026-22649: Security update for 25 packages
ELSA-2026-22649, released July 17, 2026, fixes 6 CVEs across 25 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
6
1 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0078
56th percentile
Priority of the 6 CVEs
Patch now 0
Urgent 1
High 5
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| php8.4 | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-bcmath | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-cli | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-common | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-dba | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-dbg | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-devel | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-embedded | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-enchant | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-ffi | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-fpm | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-gd | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-gmp | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-intl | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-ldap | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-mbstring | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-mysqlnd | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-odbc | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-opcache | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-pdo | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-pgsql | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-process | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-snmp | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-soap | ol 10 | 0:8.4.21-1.el10_2 |
| php8.4-xml | ol 10 | 0:8.4.21-1.el10_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-6104 | php8.4: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is... | 9.1 | 0.0047 | None reported | |
| High | CVE-2026-7262 | apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server | 8.2 | 0.0078 | None reported | |
| High | CVE-2026-7568 | apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server | 8.2 | 0.0046 | None reported | |
| High | CVE-2026-7258 | Out-of-bounds read in urldecode() on NetBSD | 8.2 | 0.0036 | None reported | |
| High | CVE-2026-7263 | php8.4: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrect... | 8.2 | 0.0035 | None reported | |
| High | CVE-2026-6735 | XSS within PHP-FPM status endpoint | 8.2 | 0.0019 | None reported |
Showing 1 to 6 of 6
1