ELSA-2026-87080: php:7.4 security update (IMPORTANT)

ALT-PU-2026-19936: package `php8.3-soap` update to version 8.3.36-alt1

ALT-PU-2026-19935: package `php8.4-soap` update to version 8.4.27-alt1

ALT-PU-2026-19934: package `php8.5-soap` update to version 8.5.12-alt1

ALT-PU-2026-19933: package `php8.2-soap` update to version 8.2.35-alt1

ALT-PU-2026-19710: package `php8.2` update to version 8.2.35-alt1

ALT-PU-2026-19692: package `php8.3` update to version 8.3.36-alt1

ALT-PU-2026-19681: package `php8.5` update to version 8.5.12-alt1

ALT-PU-2026-19675: package `php8.4` update to version 8.4.27-alt1

out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current ...

RCE via OOM corruption

Уязвимость функции longjmp() компонента session.upload_progress ядра интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

cleanup_xml_node() in the SOAP XML parser recurses once per XML nestin ...