In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0342 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-14179:
    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query     construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte,     dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This     allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL     statements.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8336-1 advisory.

    Aleksey Solovev and Nikita Sveshnikov discovered that PHP improperly handled NUL bytes when preparing SQL     queries in the PDO Firebird driver. An attacker could possibly use this issue to perform SQL injection     attacks. (CVE-2025-14179)

    It was discovered that PHP incorrectly handled certain encoding names in mbstring. An attacker could     possibly use this issue to obtain sensitive information or cause a denial of service. This issue only     affected Ubuntu 25.10 and Ubuntu 26.04 LTS. (CVE-2026-6104)

    It was discovered that PHP incorrectly handled object references while parsing crafted SOAP requests. A     remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-6722)

    It was discovered that PHP incorrectly sanitized certain data in the PHP-FPM status page. A remote     attacker could possibly use this issue to inject arbitrary JavaScript code. (CVE-2026-6735)

    It was discovered that PHP had an encoding mismatch in mbstring. An attacker could possibly use this issue     to cause PHP to crash, resulting in a denial of service. (CVE-2026-7259)

    It was discovered that PHP incorrectly handled SOAP session persistence after errors. A remote attacker     could possibly use this issue to obtain sensitive information or cause PHP to crash, resulting in a denial     of service. (CVE-2026-7261)

    It was discovered that PHP incorrectly handled missing values in SOAP typemap decoding. A remote attacker     could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7262)

    It was discovered that PHP incorrectly handled XML canonicalization in DOMNode::C14N(). An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS.
    (CVE-2026-7263)

    It was discovered that PHP incorrectly handled very long input in metaphone(). An attacker could possibly     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2037-1 advisory.

    This update for php8 fixes the following issues

    - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries     can lead to SQL       injection (bsc#1264778).
    - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
    - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS     (bsc#1264775).
    - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access     and denial of       service (bsc#1264774).
    - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can     lead to a denial       of service (bsc#1264773).
    - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when     SOAP_PERSISTENCE_SESSION       is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
    - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is     configured       can lead to a denial of service (bsc#1264771).
    - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect     the availability       of the PHPprocess (bsc#1264769).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c4d1ca4f16 advisory.

    **PHP version 8.4.21** (07 May 2026)

    **Core:**

    * Fixed bug [GH-19983](https://github.com/php/php-src/issues/19983) (GC assertion failure with fibers,     generators and destructors). (iliaal)
    * Fixed bug [GH-21478](https://github.com/php/php-src/issues/21478) (Forward property operations to real     instance for initialized lazy proxies). (iliaal)
    * Fixed bug [GH-21605](https://github.com/php/php-src/issues/21605) (Missing addref for     Countable::count()). (ilutov)
    * Fixed bug [GH-21699](https://github.com/php/php-src/issues/21699) (Assertion failure in     shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
    (macoaure)
    * Fixed bug [GH-21603](https://github.com/php/php-src/issues/21603) (Missing addref for __unset). (ilutov)
    * Fixed bug [GH-21760](https://github.com/php/php-src/issues/21760) (Trait with class constant name     conflict against enum case causes SEGV). (Pratik Bhujel)

    **CLI:**

    * Fixed bug [GH-21754](https://github.com/php/php-src/issues/21754) (`--rf` command line option with a     method triggers ext/reflection deprecation warnings). (DanielEScherzer)

    **Curl:**

    * Add support for brotli and zstd on Windows. (Shivam Mathur)

    **DOM:**

    * Fixed [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) and     [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() emits duplicate xmlns     declarations after setAttributeNS()). (**CVE-2026-7263**) (David Carlier)
    * Fixed bug [GH-21688](https://github.com/php/php-src/issues/21688) (segmentation fault on empty     HTMLDocument). (David Carlier)
    * Upgrade to lexbor v2.7.0. (**CVE-2026-29078**, **CVE-2026-29079**) (ndossche, ilutov)

    **FPM:**

    * Fixed [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (XSS     within status endpoint). (**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * Fixed bug [GH-17399](https://github.com/php/php-src/issues/17399) (iconv memory leak on bailout).
    (iliaal)

    **MBString:**

    * Fixed [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)     (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (**CVE-2026-7259**)     (vi3tL0u1s)
    * Fixed [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)     (Out-of-bounds access in mbfl_name2encoding_ex()). (**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * Fixed bug [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: Assertion jit->ra[var].flags &     (1<<0) failed in zend_jit_use_reg). (Arnaud)
    * Fixed bug [GH-21593](https://github.com/php/php-src/issues/21593) (Borked function JIT JMPNZ smart     branch). (ilutov)
    * Fixed bug [GH-21460](https://github.com/php/php-src/issues/21460) (COND optimization regression).
    (Dmitry, Arnaud)
    * Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    **OpenSSL:**

    * Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    **PDO_Firebird:**

    * Fixed [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (SQL     injection via NUL bytes in quoted strings). (**CVE-2025-14179**) (SakiTakamachi)

    **Phar:**

    * Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
    * Fixed bug [GH-21797](https://github.com/php/php-src/issues/21797) (phar: NULL dereference in     Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment). (iliaal)
    * Fix memory leak in Phar::offsetGet(). (iliaal)
    * Fix memory leak in phar_add_file(). (iliaal)
    * Fixed bug [GH-21799](https://github.com/php/php-src/issues/21799) (phar: propagate phar_stream_flush     return value from phar_stream_close). (iliaal)
    * Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    **Random:**

    * Fixed bug [GH-21731](https://github.com/php/php-src/issues/21731)     (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state). (iliaal)

    **Session:**

    * Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    **SOAP:**

    * Fixed [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)     (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (**CVE-2026-6722**) (ilutov)
    * Fixed [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)     (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (**CVE-2026-7261**) (ilutov)
    * Fixed [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)     (Broken Apache map value NULL check). (**CVE-2026-7262**) (ilutov)

    **SPL:**

    * Fixed bug [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator getChildren     UAF after parent free). (Girgias)
    * Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    **Standard:**

    * Fixed [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)     (Signed integer overflow of char array offset). (**CVE-2026-7568**) (TimWolla)
    * Fixed [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)     (Consistently pass unsigned char to ctype.h functions). (**CVE-2026-7258**) (ilutov)

    **Streams:**

    * Fixed bug [GH-21468](https://github.com/php/php-src/issues/21468) (Segfault in file_get_contents w/ a     https URL and a proxy set). (ndossche)

    **XSL:**

    * Fixed bug [GH-21600](https://github.com/php/php-src/issues/21600) (Segfault on module shutdown). (David     Carlier)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.31, 8.3.x prior to 8.3.31, 8.4.x prior to 8.4.21, or 8.5.x prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities:

 - Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS(). (CVE-2026-7263)

 - Cross-Site Scripting (XSS) within FPM status endpoint. (CVE-2026-6735)

 - Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init(). (CVE-2026-7259)

 - Out-of-bounds access in mbfl_name2encoding_ex(). (CVE-2026-6104)

 - SQL injection via NUL bytes in quoted strings in PDO_Firebird. (CVE-2025-14179)

 - Stale SOAP_GLOBAL(ref_map) pointer with Apache Map. (CVE-2026-6722)

 - Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261)

 - Broken Apache map value NULL check in SOAP. (CVE-2026-7262)

 - Signed integer overflow of char array offset. (CVE-2026-7568)

 - Inconsistent unsigned char usage with ctype.h functions. (CVE-2026-7258)

 - Numeric truncation in uriparser text range comparison (uriparser before 1.0.1). (CVE-2026-42371)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1957-1 advisory.

    This update for php8 fixes the following issues

    - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries     can lead to SQL       injection (bsc#1264778).
    - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
    - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS     (bsc#1264775).
    - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access     and denial of       service (bsc#1264774).
    - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can     lead to a denial       of service (bsc#1264773).
    - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when     SOAP_PERSISTENCE_SESSION       is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
    - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is     configured       can lead to a denial of service (bsc#1264771).
    - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect     the availability       of the PHPprocess (bsc#1264769).

    Other updates:

    - Updated to 8.2.31.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1958-1 advisory.

    This update for php8 fixes the following issues

    - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries     can lead to SQL       injection (bsc#1264778).
    - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
    - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS     (bsc#1264775).
    - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access     and denial of       service (bsc#1264774).
    - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can     lead to a denial       of service (bsc#1264773).
    - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when     SOAP_PERSISTENCE_SESSION       is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
    - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is     configured       can lead to a denial of service (bsc#1264771).
    - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect     the availability       of the PHPprocess (bsc#1264769).

    Other updates:

    - Updated to 8.3.31.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:21612-1 advisory.

    This update for php8 fixes the following issues

    - CVE-2025-14179: improper handling of NULL bytes by the PDO Firebird driver when preparing SQL queries     can lead to SQL       injection (bsc#1264778).
    - CVE-2026-6104: out-of-bounds read when processing an encoding name containing an embedded NULL byte in       `mb_convert_encoding()` can lead to information disclosure and denial of service (bsc#1264777).
    - CVE-2026-6722: use-after-free in SOAP using Apache map can lead to remote code execution (bsc#1264776).
    - CVE-2026-6735: improper validation of the request URI within the PHP-FPM status page can lead to XSS     (bsc#1264775).
    - CVE-2026-7258: signed `char` values passed to `ctype` functions like `isxdigit` can lead to OOB access     and denial of       service (bsc#1264774).
    - CVE-2026-7259: NULL pointer dereference in `php_mb_check_encoding()` via `mb_ereg_search_init()` can     lead to a denial       of service (bsc#1264773).
    - CVE-2026-7261: use-after-free due to incorrectly handled persistence of handler objects when     SOAP_PERSISTENCE_SESSION       is configured can lead to memory corruption, information disclosure and process crashes (bsc#1264772).
    - CVE-2026-7262: NULL pointer dereference caused by mistake in the SOAP decoding process when a typemap is     configured       can lead to a denial of service (bsc#1264771).
    - CVE-2026-7263: incorrect processing of XML data in the `DOMNode: C14N()` method can lead to an infinite     loop and a       denial of service (bsc#1264770).
    - CVE-2026-7568: integer overflow in the `metaphone` function can lead to undefined behavior and affect     the availability       of the PHPprocess (bsc#1264769).

    Other updates:

    - Updated to 8.4.21.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a58db70ca advisory.

    **PHP version 8.4.21** (07 May 2026)

    **Core:**

    * Fixed bug [GH-19983](https://github.com/php/php-src/issues/19983) (GC assertion failure with fibers,     generators and destructors). (iliaal)
    * Fixed bug [GH-21478](https://github.com/php/php-src/issues/21478) (Forward property operations to real     instance for initialized lazy proxies). (iliaal)
    * Fixed bug [GH-21605](https://github.com/php/php-src/issues/21605) (Missing addref for     Countable::count()). (ilutov)
    * Fixed bug [GH-21699](https://github.com/php/php-src/issues/21699) (Assertion failure in     shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
    (macoaure)
    * Fixed bug [GH-21603](https://github.com/php/php-src/issues/21603) (Missing addref for __unset). (ilutov)
    * Fixed bug [GH-21760](https://github.com/php/php-src/issues/21760) (Trait with class constant name     conflict against enum case causes SEGV). (Pratik Bhujel)

    **CLI:**

    * Fixed bug [GH-21754](https://github.com/php/php-src/issues/21754) (`--rf` command line option with a     method triggers ext/reflection deprecation warnings). (DanielEScherzer)

    **Curl:**

    * Add support for brotli and zstd on Windows. (Shivam Mathur)

    **DOM:**

    * Fixed [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) and     [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() emits duplicate xmlns     declarations after setAttributeNS()). (**CVE-2026-7263**) (David Carlier)
    * Fixed bug [GH-21688](https://github.com/php/php-src/issues/21688) (segmentation fault on empty     HTMLDocument). (David Carlier)
    * Upgrade to lexbor v2.7.0. (**CVE-2026-29078**, **CVE-2026-29079**) (ndossche, ilutov)

    **FPM:**

    * Fixed [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (XSS     within status endpoint). (**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * Fixed bug [GH-17399](https://github.com/php/php-src/issues/17399) (iconv memory leak on bailout).
    (iliaal)

    **MBString:**

    * Fixed [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)     (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (**CVE-2026-7259**)     (vi3tL0u1s)
    * Fixed [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)     (Out-of-bounds access in mbfl_name2encoding_ex()). (**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * Fixed bug [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: Assertion jit->ra[var].flags &     (1<<0) failed in zend_jit_use_reg). (Arnaud)
    * Fixed bug [GH-21593](https://github.com/php/php-src/issues/21593) (Borked function JIT JMPNZ smart     branch). (ilutov)
    * Fixed bug [GH-21460](https://github.com/php/php-src/issues/21460) (COND optimization regression).
    (Dmitry, Arnaud)
    * Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    **OpenSSL:**

    * Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    **PDO_Firebird:**

    * Fixed [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (SQL     injection via NUL bytes in quoted strings). (**CVE-2025-14179**) (SakiTakamachi)

    **Phar:**

    * Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
    * Fixed bug [GH-21797](https://github.com/php/php-src/issues/21797) (phar: NULL dereference in     Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment). (iliaal)
    * Fix memory leak in Phar::offsetGet(). (iliaal)
    * Fix memory leak in phar_add_file(). (iliaal)
    * Fixed bug [GH-21799](https://github.com/php/php-src/issues/21799) (phar: propagate phar_stream_flush     return value from phar_stream_close). (iliaal)
    * Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    **Random:**

    * Fixed bug [GH-21731](https://github.com/php/php-src/issues/21731)     (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state). (iliaal)

    **Session:**

    * Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    **SOAP:**

    * Fixed [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)     (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (**CVE-2026-6722**) (ilutov)
    * Fixed [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)     (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (**CVE-2026-7261**) (ilutov)
    * Fixed [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)     (Broken Apache map value NULL check). (**CVE-2026-7262**) (ilutov)

    **SPL:**

    * Fixed bug [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator getChildren     UAF after parent free). (Girgias)
    * Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    **Standard:**

    * Fixed [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)     (Signed integer overflow of char array offset). (**CVE-2026-7568**) (TimWolla)
    * Fixed [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)     (Consistently pass unsigned char to ctype.h functions). (**CVE-2026-7258**) (ilutov)

    **Streams:**

    * Fixed bug [GH-21468](https://github.com/php/php-src/issues/21468) (Segfault in file_get_contents w/ a     https URL and a proxy set). (ndossche)

    **XSL:**

    * Fixed bug [GH-21600](https://github.com/php/php-src/issues/21600) (Segfault on module shutdown). (David     Carlier)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c66eaae759 advisory.

    **PHP version 8.5.6** (07 May 2026)

    **Core:**

    * Fixed bug [GH-19983](https://github.com/php/php-src/issues/19983) (GC assertion failure with fibers,     generators and destructors). (iliaal)
    * Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang. (henderkes)
    * Fixed bug [GH-21504](https://github.com/php/php-src/issues/21504) (Incorrect RC-handling for     ZEND_EXT_STMT op1). (ilutov)
    * Fixed bug [GH-21478](https://github.com/php/php-src/issues/21478) (Forward property operations to real     instance for initialized lazy proxies). (iliaal)
    * Fixed bug [GH-21605](https://github.com/php/php-src/issues/21605) (Missing addref for     Countable::count()). (ilutov)
    * Fixed bug [GH-21699](https://github.com/php/php-src/issues/21699) (Assertion failure in     shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
    (macoaure)
    * Fixed bug [GH-21603](https://github.com/php/php-src/issues/21603) (Missing addref for __unset). (ilutov)
    * Fixed bug [GH-21760](https://github.com/php/php-src/issues/21760) (Trait with class constant name     conflict against enum case causes SEGV). (Pratik Bhujel)

    **CLI:**

    * Fixed bug [GH-21754](https://github.com/php/php-src/issues/21754) (`--rf` command line option with a     method triggers ext/reflection deprecation warnings). (DanielEScherzer)

    **Curl:**

    * Add support for brotli and zstd on Windows. (Shivam Mathur)

    **DOM:**

    * Fixed [GHSA-4jhr-8w89-j733](https://github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733) and     [GH-21566](https://github.com/php/php-src/issues/21566) (Dom\XMLDocument::C14N() emits duplicate xmlns     declarations after setAttributeNS()). (**CVE-2026-7263**) (David Carlier)

    **FPM:**

    * Fixed [GHSA-7qg2-v9fj-4mwv](https://github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv) (XSS     within status endpoint). (**CVE-2026-6735**) (Jakub Zelenka)

    **Iconv:**

    * Fixed bug [GH-17399](https://github.com/php/php-src/issues/17399) (iconv memory leak on bailout).
    (iliaal)

    **Lexbor:**

    * Upgrade to lexbor v2.7.0. (**CVE-2026-29078**, **CVE-2026-29079**) (ndossche, ilutov)

    **MBString:**

    * Fixed [GHSA-wm6j-2649-pv75](https://github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75)     (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (**CVE-2026-7259**)     (vi3tL0u1s)
    * Fixed [GHSA-74r9-qxhc-fx53](https://github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53)     (Out-of-bounds access in mbfl_name2encoding_ex()). (**CVE-2026-6104**) (ilutov)

    **Opcache:**

    * Fixed bug [GH-21158](https://github.com/php/php-src/issues/21158) (JIT: Assertion jit->ra[var].flags &     (1<<0) failed in zend_jit_use_reg). (Arnaud)
    * Fixed bug [GH-21593](https://github.com/php/php-src/issues/21593) (Borked function JIT JMPNZ smart     branch). (ilutov)
    * Fixed bug [GH-21460](https://github.com/php/php-src/issues/21460) (COND optimization regression).
    (Dmitry, Arnaud)
    * Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    **OpenSSL:**

    * Fix memory leak regression in openssl_pbkdf2(). (ndossche)
    * Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    **PDO_Firebird:**

    * Fixed [GHSA-w476-322c-wpvm](https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm) (SQL     injection via NUL bytes in quoted strings). (**CVE-2025-14179**) (SakiTakamachi)

    **PDO_PGSQL:**

    * Fixed bug [GH-21683](https://github.com/php/php-src/issues/21683) (pdo_pgsql throws with ATTR_PREFETCH=0     on empty result set). (thomasschiet)

    **Phar:**

    * Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
    * Fixed bug [GH-21797](https://github.com/php/php-src/issues/21797) (phar: NULL dereference in     Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment). (iliaal)
    * Fix memory leak in Phar::offsetGet(). (iliaal)
    * Fix memory leak in phar_add_file(). (iliaal)
    * Fixed bug [GH-21799](https://github.com/php/php-src/issues/21799) (phar: propagate phar_stream_flush     return value from phar_stream_close). (iliaal)
    * Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    **Random:**

    * Fixed bug [GH-21731](https://github.com/php/php-src/issues/21731)     (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state). (iliaal)

    **Session:**

    * Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    **SOAP:**

    * Fixed [GHSA-85c2-q967-79q5](https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5)     (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (**CVE-2026-6722**) (ilutov)
    * Fixed [GHSA-m33r-qmcv-p97q](https://github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q)     (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (**CVE-2026-7261**) (ilutov)
    * Fixed [GHSA-hmxp-6pc4-f3vv](https://github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv)     (Broken Apache map value NULL check). (**CVE-2026-7262**) (ilutov)

    **SPL:**

    * Fixed bug [GH-21499](https://github.com/php/php-src/issues/21499) (RecursiveArrayIterator getChildren     UAF after parent free). (Girgias)
    * Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    **Sqlite3:**

    * Fixed wrong free list comparator pointer type. (David Carlier)

    **Standard:**

    * Fixed [GHSA-96wq-48vp-hh57](https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57)     (Signed integer overflow of char array offset). (**CVE-2026-7568**) (TimWolla)
    * Fixed [GHSA-m8rr-4c36-8gq4](https://github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4)     (Consistently pass unsigned char to ctype.h functions). (**CVE-2026-7258**) (ilutov)

    **Streams:**

    * Fixed bug [GH-21468](https://github.com/php/php-src/issues/21468) (Segfault in file_get_contents w/ a     https URL and a proxy set). (ndossche)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6255 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6255-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 08, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php8.2     CVE ID         : CVE-2025-14179 CVE-2026-6722 CVE-2026-6735 CVE-2026-7258                      CVE-2026-7259 CVE-2026-7261 CVE-2026-7262 CVE-2026-7568

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language which could result in denial of     service, SQL injection, cross-site scripting or the execution of     arbitrary code.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 8.2.31-1~deb12u1.

    We recommend that you upgrade your php8.2 packages.

    For the detailed security status of php8.2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6256 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6256-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 08, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php8.4     CVE ID         : CVE-2025-14179 CVE-2026-6104 CVE-2026-6722 CVE-2026-6735                      CVE-2026-7258 CVE-2026-7259 CVE-2026-7261 CVE-2026-7262                      CVE-2026-7263 CVE-2026-7568

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language which could result in denial of     service, SQL injection, cross-site scripting, information disclosure     or the execution of arbitrary code.

    For the stable distribution (trixie), these problems have been fixed in     version 8.4.21-1~deb13u1.

    We recommend that you upgrade your php8.4 packages.

    For the detailed security status of php8.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.4

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query     construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte,     dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This     allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL     statements. (CVE-2025-14179)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of php82 installed on the remote host is prior to 8.2.31 / 8.4.21. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-127-03 advisory.

    New php packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the php82 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.4.21. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.21 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.31. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.31 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.31. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.31 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.6 advisory.

  - uriparser before 1.0.1 has numeric truncation in text range comparison, if an application accepts URIs     with a length in gigabytes. (CVE-2026-42371)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
319749	TencentOS Server 4: php (TSSA-2026:0342)	Nessus	Tencent Local Security Checks	high
318235	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : PHP vulnerabilities (USN-8336-1)	Nessus	Ubuntu Local Security Checks	critical
316722	SUSE SLES15 Security Update : php8 (SUSE-SU-2026:2037-1)	Nessus	SuSE Local Security Checks	critical
315615	Fedora 43 : php (2026-c4d1ca4f16)	Nessus	Fedora Local Security Checks	critical
115237	PHP 8.2.x < 8.2.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115236	PHP 8.3.x < 8.3.31 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115235	PHP 8.4.x < 8.4.21 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
115234	PHP 8.5.x < 8.5.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
315258	SUSE SLES15 Security Update : php8 (SUSE-SU-2026:1957-1)	Nessus	SuSE Local Security Checks	critical
315251	SUSE SLES15 Security Update : php8 (SUSE-SU-2026:1958-1)	Nessus	SuSE Local Security Checks	critical
315067	SUSE SLES16 Security Update : php8 (SUSE-SU-2026:21612-1)	Nessus	SuSE Local Security Checks	critical
314603	Fedora 42 : php (2026-3a58db70ca)	Nessus	Fedora Local Security Checks	critical
313734	Fedora 44 : php (2026-c66eaae759)	Nessus	Fedora Local Security Checks	critical
313418	Debian dsa-6255 : libapache2-mod-php8.2 - security update	Nessus	Debian Local Security Checks	critical
313417	Debian dsa-6256 : libapache2-mod-php8.4 - security update	Nessus	Debian Local Security Checks	critical
313265	Linux Distros Unpatched Vulnerability : CVE-2025-14179	Nessus	Misc.	high
313196	Slackware Linux 15.0 / current php82 Multiple Vulnerabilities (SSA:2026-127-03)	Nessus	Slackware Local Security Checks	critical
313115	PHP 8.4.x < 8.4.21 Multiple Vulnerabilities	Nessus	CGI abuses	critical
313114	PHP 8.3.x < 8.3.31 Multiple Vulnerabilities	Nessus	CGI abuses	critical
313113	PHP 8.2.x < 8.2.31 Multiple Vulnerabilities	Nessus	CGI abuses	critical
313112	PHP 8.5.x < 8.5.6 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2025-14179

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical