Skip to main content

Alert GCSA-26156 - Vulnerabilita' multiple in PHP 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   alert ID: GCSA-26156
       data: 03 agosto 2026
     titolo: Vulnerabilita' multiple in PHP

******************************************************************

:: Descrizione del problema

   Sono state rilasciate nuove versioni del linguaggio di scripting PHP,
   con le quali vengono risolte 4 vulnerabilita'.

   Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

   PHP versioni precedenti alla 8.5.9
   PHP versioni precedenti alla 8.4.24
   PHP versioni precedenti alla 8.3.33
   PHP versioni precedenti alla 8.2.33


:: Impatto

   SQL Injection (SQLi)
   Denial of Service (DoS)
   Esecuzione remota di codice arbitrario (RCE)
   Bypass delle funzionalita' di sicurezza (SFB)


:: Soluzioni

   Aggiornare il software alle versioni piu' recenti

   https://www.php.net/downloads.php


:: Riferimenti

   PHP.net
   https://www.php.net/index.php#2026-07-30-2
   https://www.php.net/index.php#2026-07-30-5
   https://www.php.net/index.php#2026-07-30-4
   https://www.php.net/index.php#2026-07-30-1

   PHP.net - ChangeLog
   https://www.php.net/ChangeLog-8.php#8.5.9
   https://www.php.net/ChangeLog-8.php#8.4.24
   https://www.php.net/ChangeLog-8.php#8.3.33
   https://www.php.net/ChangeLog-8.php#8.2.33

   Debian Security Announce
   https://lists.debian.org/debian-security-announce/2026/msg00317.html
   https://security-tracker.debian.org/tracker/DSA-6406-1

   openSUSE security announce
   https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/QIDWX7PBW4757RIV7X4AFVPIA4OTSMTC/

   Mitre's CVE ID
   https://www.cve.org/CVERecord?id=CVE-2026-7260
   https://www.cve.org/CVERecord?id=CVE-2026-9672
   https://www.cve.org/CVERecord?id=CVE-2026-17543
   https://www.cve.org/CVERecord?id=CVE-2026-17544


GARR CERT Security Alert -  subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert

-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCanBPBgAKCRDBnEyTZRJg
QmVCAJ4tEVKaM1hyQb0Y0jgI37E5lGIJrQCgnUb6yX4Q8R9U2uEIqgdO4b8onb4=
=3XPn
-----END PGP SIGNATURE-----