Red Hat says default RHEL 7 PHP 5.4.16 is vulnerable to CVE-2026-109619
Original title: Re: CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6)
An October 23 note says updated RHSB-2026-013 and VEX data reverse an earlier PHP 5 risk claim.
Oleksii Molchanov corrected the “Risk on PHP 5” section after Red Hat updated its data. Bulletin RHSB-2026-013, updated October 22, and VEX data from October 23 say php-5.4.16 on RHEL 7 is vulnerable to CVE-2026-109619 in a default configuration. The post begins to contrast code required for CVE-2026-109618, but the available text cuts off.
Unconfirmed: The snippet cuts off before explaining how CVE-2026-109618 applies, and no fixed version is stated.
- The correction was posted on October 23.
- RHSB-2026-013 was updated on October 22 at 15:47 UTC.
- Red Hat says only CVE-2026-109619 affects default RHEL 7 php-5.4.16.
- The snippet does not state a fixed PHP version.
Impact: Default RHEL 7 PHP 5.4.16 vulnerable to CVE-2026-109619
| Product | Affected |
|---|---|
| Red Hat PHP | php-5.4.16 on RHEL 7 |
- 1.Check Red Hat RHSB-2026-013 and VEX data for php-5.4.16 on RHEL 7.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
Posted by Oleksii Molchanov on Oct 23 Hi, A correction to the "Risk on PHP 5" part of my message, after Red Hat updated its data: Red Hat's bulletin RHSB-2026-013 (updated on 22 Oct, 15:47 UTC) and, since 23 Oct, its VEX data say the opposite for CVE-2026-109619 on RHEL 7 (php-5. 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.