Linux · Fedora · Security advisory · November 7, 2026

FEDORA-2026-D5F8446449: Security update for 58 packages

FEDORA-2026-D5F8446449, released November 7, 2026, fixes 3 CVEs across 58 products. 2 of them are being exploited (CVE-2026-109618); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV
CVEs closed
3
2 rated Critical
Exploited
2
CVE-2026-109618
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
1.0000
99th percentile

Priority of the 3 CVEs

Patch now 2 Urgent 0 High 1 Routine 0

Fixed package versions

ProductReleaseFixed in
phpFedora 438.4.27-2.fc43
php-bcmathFedora 438.4.27-2.fc43
php-bcmath-debuginfoFedora 438.4.27-2.fc43
php-cliFedora 438.4.27-2.fc43
php-cli-debuginfoFedora 438.4.27-2.fc43
php-commonFedora 438.4.27-2.fc43
php-common-debuginfoFedora 438.4.27-2.fc43
php-dbaFedora 438.4.27-2.fc43
php-dba-debuginfoFedora 438.4.27-2.fc43
php-dbgFedora 438.4.27-2.fc43
php-dbg-debuginfoFedora 438.4.27-2.fc43
php-debuginfoFedora 438.4.27-2.fc43
php-debugsourceFedora 438.4.27-2.fc43
php-develFedora 438.4.27-2.fc43
php-embeddedFedora 438.4.27-2.fc43
php-embedded-debuginfoFedora 438.4.27-2.fc43
php-enchantFedora 438.4.27-2.fc43
php-enchant-debuginfoFedora 438.4.27-2.fc43
php-ffiFedora 438.4.27-2.fc43
php-ffi-debuginfoFedora 438.4.27-2.fc43
php-fpmFedora 438.4.27-2.fc43
php-fpm-debuginfoFedora 438.4.27-2.fc43
php-gdFedora 438.4.27-2.fc43
php-gd-debuginfoFedora 438.4.27-2.fc43
php-gmpFedora 438.4.27-2.fc43
php-gmp-debuginfoFedora 438.4.27-2.fc43
php-intlFedora 438.4.27-2.fc43
php-intl-debuginfoFedora 438.4.27-2.fc43
php-ldapFedora 438.4.27-2.fc43
php-ldap-debuginfoFedora 438.4.27-2.fc43
php-mbstringFedora 438.4.27-2.fc43
php-mbstring-debuginfoFedora 438.4.27-2.fc43
php-mysqlndFedora 438.4.27-2.fc43
php-mysqlnd-debuginfoFedora 438.4.27-2.fc43
php-odbcFedora 438.4.27-2.fc43
php-odbc-debuginfoFedora 438.4.27-2.fc43
php-opcacheFedora 438.4.27-2.fc43
php-opcache-debuginfoFedora 438.4.27-2.fc43
php-pdoFedora 438.4.27-2.fc43
php-pdo-dblibFedora 438.4.27-2.fc43
php-pdo-dblib-debuginfoFedora 438.4.27-2.fc43
php-pdo-debuginfoFedora 438.4.27-2.fc43
php-pdo-firebirdFedora 438.4.27-2.fc43
php-pdo-firebird-debuginfoFedora 438.4.27-2.fc43
php-pgsqlFedora 438.4.27-2.fc43
php-pgsql-debuginfoFedora 438.4.27-2.fc43
php-processFedora 438.4.27-2.fc43
php-process-debuginfoFedora 438.4.27-2.fc43
php-snmpFedora 438.4.27-2.fc43
php-snmp-debuginfoFedora 438.4.27-2.fc43
php-soapFedora 438.4.27-2.fc43
php-soap-debuginfoFedora 438.4.27-2.fc43
php-sodiumFedora 438.4.27-2.fc43
php-sodium-debuginfoFedora 438.4.27-2.fc43
php-tidyFedora 438.4.27-2.fc43
php-tidy-debuginfoFedora 438.4.27-2.fc43
php-xmlFedora 438.4.27-2.fc43
php-xml-debuginfoFedora 438.4.27-2.fc43

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2026-109618 php8.1-gd: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request9.8 1.0000 KEVExploited
Patch now CVE-2026-109619 libapache2-mod-php7.4: PHP has various global state that temporarily points into request memory8.1 1.0000 KEVExploited
High CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node8.1 0.0038 None reported
Showing 1 to 3 of 3 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.