The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792615126 advisory.

  - PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the     request. Some contexts may not properly account for this scenario and leave request memory in an     uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or     branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote     code execution (RCE). (CVE-2026-109618)

  - A critical vulnerability has been discovered in PHP that will be addressed in a Critical PHP Security     Release on October 21, 2026. Full details have not yet been shared, but public reporting from several     trusted sources indicates this is one of the two CVEs that will be included in this release. When this     flaw is chained with another PHP vulnerability, attackers could gain remote code execution. The chain has     been dubbed php2shell by researchers at Calif. This description will be updated once PHP publishes full     details. (CVE-2026-109618, CVE-2026-109619)

  - PHP has various global state that temporarily points into request memory. In some scenarios, global state     may not be correctly reset, or may be repopulated after being reset. The global state may then refer to     request memory even after it has been freed. Subsequent requests may read or branch on this stale state     before it is fully initialized. Multiple strategies can trigger this condition and produce remote code     execution (RCE). (CVE-2026-109619)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 7 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792615126)

critical Nessus Plugin ID 370870

Version 1.6

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Nov 5, 2026, 5:43 PM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202611051743
Version 1.4 Oct 27, 2026, 9:59 AM CISA reference Plugin Feed: 202610270959
Version 1.3 Oct 26, 2026, 2:57 PM CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:A") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202610261457
Version 1.2 Oct 23, 2026, 5:56 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202610231756
Version 1.1 Oct 23, 2026, 5:20 AM New Plugin Feed: 202610230520