It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1726 advisory.

    PHP: Failure to setup TLS with a remote server can result in a remote DoS (CVE-2026-12184)

    Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the     SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without     incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the     second entry overwrites the first in the temporary result map, freeing the original PHP object while its     stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling     pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with     control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
    (CVE-2026-6722)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to     improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to     execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM     status page. (CVE-2026-6735)

    Out-of-bounds read in urldecode() (CVE-2026-7258)

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6,     when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across     requests via session storage. However, in the case SOAP requests results in an error, the persistance is     handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-     after-free. This may lead to memory corruption, information disclosure, or process crashes, with     confidentiality, integrity, and availability impact on the vulnerable system. (CVE-2026-7261)

    NULL pointer dereference in SOAP apache:Map decoder with missing <value> (CVE-2026-7262)

    DoS attack via DOMNode::C14N(). In DOMNode::C14N(), improper removal of a xmlns libxml2 attribute from a     doubly linked list can lead to a corrupt, circular linked list. The linked list is iterated in many places     in PHP and libxml2, leading to DoS through segfaults, or temporal and spatial resource starvation.
    (CVE-2026-7263)

    Signed integer overflow in metaphone() (CVE-2026-7568)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-1726)

critical Nessus Plugin ID 316837

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jul 16, 2026, 9:04 PM CVE (set "CVE" coverage to "CVE-2026-12184,CVE-2026-6104,CVE-2026-6722,CVE-2026-6735,CVE-2026-7258,CVE-2026-7259,CVE-2026-7261,CVE-2026-7262,CVE-2026-7263,CVE-2026-7568") Detection (updated detection logic) Plugin metadata Plugin Feed: 202607162104
Version 1.2 May 29, 2026, 5:27 PM Plugin metadata Plugin Feed: 202605291727
Version 1.1 May 27, 2026, 7:09 AM New Plugin Feed: 202605270709