An update for php is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4414 Final 1.0 1.0 2026-10-22 Initial 2026-10-22 2026-10-22 openEuler SA Tool V1.0 2026-10-22 php security update An update for php is now available for openEuler-22.03-LTS-SP4 PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. Security Fix(es): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).(CVE-2026-109618) PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).(CVE-2026-109619) An update for php is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical php https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4414 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109618 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-109619 https://nvd.nist.gov/vuln/detail/CVE-2026-109618 https://nvd.nist.gov/vuln/detail/CVE-2026-109619 openEuler-22.03-LTS-SP4 php-8.0.30-18.oe2203sp4.src.rpm php-8.0.30-18.oe2203sp4.x86_64.rpm php-bcmath-8.0.30-18.oe2203sp4.x86_64.rpm php-cli-8.0.30-18.oe2203sp4.x86_64.rpm php-common-8.0.30-18.oe2203sp4.x86_64.rpm php-dba-8.0.30-18.oe2203sp4.x86_64.rpm php-dbg-8.0.30-18.oe2203sp4.x86_64.rpm php-debuginfo-8.0.30-18.oe2203sp4.x86_64.rpm php-debugsource-8.0.30-18.oe2203sp4.x86_64.rpm php-devel-8.0.30-18.oe2203sp4.x86_64.rpm php-embedded-8.0.30-18.oe2203sp4.x86_64.rpm php-enchant-8.0.30-18.oe2203sp4.x86_64.rpm php-ffi-8.0.30-18.oe2203sp4.x86_64.rpm php-fpm-8.0.30-18.oe2203sp4.x86_64.rpm php-gd-8.0.30-18.oe2203sp4.x86_64.rpm php-gmp-8.0.30-18.oe2203sp4.x86_64.rpm php-intl-8.0.30-18.oe2203sp4.x86_64.rpm php-ldap-8.0.30-18.oe2203sp4.x86_64.rpm php-mbstring-8.0.30-18.oe2203sp4.x86_64.rpm php-mysqlnd-8.0.30-18.oe2203sp4.x86_64.rpm php-odbc-8.0.30-18.oe2203sp4.x86_64.rpm php-opcache-8.0.30-18.oe2203sp4.x86_64.rpm php-pdo-8.0.30-18.oe2203sp4.x86_64.rpm php-pgsql-8.0.30-18.oe2203sp4.x86_64.rpm php-process-8.0.30-18.oe2203sp4.x86_64.rpm php-snmp-8.0.30-18.oe2203sp4.x86_64.rpm php-soap-8.0.30-18.oe2203sp4.x86_64.rpm php-sodium-8.0.30-18.oe2203sp4.x86_64.rpm php-tidy-8.0.30-18.oe2203sp4.x86_64.rpm php-xml-8.0.30-18.oe2203sp4.x86_64.rpm php-help-8.0.30-18.oe2203sp4.noarch.rpm php-8.0.30-18.oe2203sp4.aarch64.rpm php-bcmath-8.0.30-18.oe2203sp4.aarch64.rpm php-cli-8.0.30-18.oe2203sp4.aarch64.rpm php-common-8.0.30-18.oe2203sp4.aarch64.rpm php-dba-8.0.30-18.oe2203sp4.aarch64.rpm php-dbg-8.0.30-18.oe2203sp4.aarch64.rpm php-debuginfo-8.0.30-18.oe2203sp4.aarch64.rpm php-debugsource-8.0.30-18.oe2203sp4.aarch64.rpm php-devel-8.0.30-18.oe2203sp4.aarch64.rpm php-embedded-8.0.30-18.oe2203sp4.aarch64.rpm php-enchant-8.0.30-18.oe2203sp4.aarch64.rpm php-ffi-8.0.30-18.oe2203sp4.aarch64.rpm php-fpm-8.0.30-18.oe2203sp4.aarch64.rpm php-gd-8.0.30-18.oe2203sp4.aarch64.rpm php-gmp-8.0.30-18.oe2203sp4.aarch64.rpm php-intl-8.0.30-18.oe2203sp4.aarch64.rpm php-ldap-8.0.30-18.oe2203sp4.aarch64.rpm php-mbstring-8.0.30-18.oe2203sp4.aarch64.rpm php-mysqlnd-8.0.30-18.oe2203sp4.aarch64.rpm php-odbc-8.0.30-18.oe2203sp4.aarch64.rpm php-opcache-8.0.30-18.oe2203sp4.aarch64.rpm php-pdo-8.0.30-18.oe2203sp4.aarch64.rpm php-pgsql-8.0.30-18.oe2203sp4.aarch64.rpm php-process-8.0.30-18.oe2203sp4.aarch64.rpm php-snmp-8.0.30-18.oe2203sp4.aarch64.rpm php-soap-8.0.30-18.oe2203sp4.aarch64.rpm php-sodium-8.0.30-18.oe2203sp4.aarch64.rpm php-tidy-8.0.30-18.oe2203sp4.aarch64.rpm php-xml-8.0.30-18.oe2203sp4.aarch64.rpm PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). 2026-10-22 CVE-2026-109618 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H php security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4414 PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). 2026-10-22 CVE-2026-109619 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H php security update 2026-10-22 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4414