{"document":{"aggregate_severity":{"text":"kritisch"},"category":"csaf_base","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"de-DE","notes":[{"category":"legal_disclaimer","text":"Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."},{"category":"description","text":"PHP ist eine Programmiersprache, die zur Implementierung von Web-Applikationen genutzt wird.","title":"Produktbeschreibung"},{"category":"summary","text":"Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um Speicherinhalte offenzulegen, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.","title":"Angriff"},{"category":"general","text":"- Linux\n- UNIX\n- Windows","title":"Betroffene Betriebssysteme"}],"publisher":{"category":"other","contact_details":"csaf-provider@cert-bund.de","name":"Bundesamt für Sicherheit in der Informationstechnik","namespace":"https://www.bsi.bund.de"},"references":[{"category":"self","summary":"WID-SEC-W-2026-4055 - CSAF Version","url":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4055.json"},{"category":"self","summary":"WID-SEC-2026-4055 - Portal Version","url":"https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4055"},{"category":"external","summary":"PHP 20 Oct 2026 Upcoming Critical PHP Security Release vom 2026-10-20","url":"https://www.php.net/archive/2026.php#2026-10-20-1"},{"category":"external","summary":"CERT EU vom 2026-10-20","url":"https://cert.europa.eu/publications/security-advisories/2026-018/"},{"category":"external","summary":"Arch Linux Security Advisory ASA-202610-1 vom 2026-10-21","url":"https://security.archlinux.org/ASA-202610-1"},{"category":"external","summary":"CheckMK Werk  19262 vom 2026-10-21","url":"https://checkmk.com/werk/19262"},{"category":"external","summary":"Google Cloud Platform Security Bulletin GCP-2026-070 vom 2026-10-21","url":"https://docs.cloud.google.com/support/bulletins#gcp-2026-070"},{"category":"external","summary":"cPanel & WHM Documentation vom 2026-10-21","url":"https://docs.cpanel.net/changelogs/110-change-log/"},{"category":"external","summary":"cPanel & WHM Documentation vom 2026-10-21","url":"https://docs.cpanel.net/changelogs/134-change-log/"},{"category":"external","summary":"cPanel & WHM Documentation vom 2026-10-21","url":"https://docs.cpanel.net/changelogs/136-change-log/"},{"category":"external","summary":"cPanel & WHM Documentation vom 2026-10-21","url":"https://docs.cpanel.net/changelogs/138-change-log/"},{"category":"external","summary":"Rocky Linux Security Advisory RLSA-2026:87070 vom 2026-10-22","url":"https://errata.build.resf.org/RLSA-2026:87070"},{"category":"external","summary":"Rocky Linux Security Advisory RLSA-2026:87071 vom 2026-10-22","url":"https://errata.build.resf.org/RLSA-2026:87071"},{"category":"external","summary":"Rocky Linux Security Advisory RLSA-2026:87072 vom 2026-10-22","url":"https://errata.build.resf.org/RLSA-2026:87072"},{"category":"external","summary":"Rocky Linux Security Advisory RLSA-2026:87079 vom 2026-10-22","url":"https://errata.build.resf.org/RLSA-2026:87079"},{"category":"external","summary":"Rocky Linux Security Advisory RLSA-2026:87151 vom 2026-10-22","url":"https://errata.build.resf.org/RLSA-2026:87151"},{"category":"external","summary":"Oracle Linux Security Advisory ELSA-2026-87070 vom 2026-10-22","url":"https://linux.oracle.com/errata/ELSA-2026-87070.html"},{"category":"external","summary":"Oracle Linux Security Advisory ELSA-2026-87071 vom 2026-10-22","url":"https://linux.oracle.com/errata/ELSA-2026-87071.html"},{"category":"external","summary":"SUSE Security Update SUSE-SU-2026:4844-1 vom 2026-10-21","url":"https://lists.suse.com/pipermail/sle-security-updates/2026-October/030008.html"},{"category":"external","summary":"SUSE Security Update SUSE-SU-2026:4843-1 vom 2026-10-21","url":"https://lists.suse.com/pipermail/sle-security-updates/2026-October/030009.html"},{"category":"external","summary":"Oracle Linux Security Advisory ELSA-2026-87151 vom 2026-10-22","url":"https://linux.oracle.com/errata/ELSA-2026-87151.html"},{"category":"external","summary":"Debian Security Advisory DLA-4848 vom 2026-10-21","url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00042.html"},{"category":"external","summary":"Matomo Changelog vom 2026-10-22","url":"https://matomo.org/changelog/matomo-5-14-2/"},{"category":"external","summary":"F5 Security Advisory K000163821 vom 2026-10-21","url":"https://my.f5.com/manage/s/article/K000163821"},{"category":"external","summary":"Ubuntu Security Notice USN-8948-1 vom 2026-10-21","url":"https://ubuntu.com/security/notices/USN-8948-1"},{"category":"external","summary":"Ubuntu Security Notice USN-8948-2 vom 2026-10-21","url":"https://ubuntu.com/security/notices/USN-8948-2"},{"category":"external","summary":"Debian Security Advisory DSA-6574 vom 2026-10-21","url":"https://security-tracker.debian.org/tracker/DSA-6574-1"},{"category":"external","summary":"Arch Linux Security Advisory ASA-202610-2 vom 2026-10-21","url":"https://security.archlinux.org/ASA-202610-2"},{"category":"external","summary":"Red Hat Security Advisory RHSA-2026:87070 vom 2026-10-22","url":"https://access.redhat.com/errata/RHSA-2026:87070"},{"category":"external","summary":"Red Hat Security Advisory RHSA-2026:87071 vom 2026-10-22","url":"https://access.redhat.com/errata/RHSA-2026:87071"},{"category":"external","summary":"Red Hat Security Advisory RHSA-2026:87072 vom 2026-10-21","url":"https://access.redhat.com/errata/RHSA-2026:87072"},{"category":"external","summary":"Red Hat Security Advisory RHSA-2026:87073 vom 2026-10-22","url":"https://access.redhat.com/errata/RHSA-2026:87073"},{"category":"external","summary":"Red Hat Security Advisory RHSA-2026:87079 vom 2026-10-21","url":"https://access.redhat.com/errata/RHSA-2026:87079"},{"category":"external","summary":"Red Hat Security Advisory RHSA-2026:87080 vom 2026-10-21","url":"https://access.redhat.com/errata/RHSA-2026:87080"},{"category":"external","summary":"Red Hat Security Advisory RHSA-2026:87151 vom 2026-10-21","url":"https://access.redhat.com/errata/RHSA-2026:87151"},{"category":"external","summary":"Amazon Linux Security Advisory ALAS2PHP8.2-2026-015 vom 2026-10-22","url":"https://alas.aws.amazon.com/AL2/ALAS2PHP8.2-2026-015.html"},{"category":"external","summary":"Fedora Security Advisory FEDORA-2026-A9354B8A1E vom 2026-10-21","url":"https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9354b8a1e"},{"category":"external","summary":"Fedora Security Advisory FEDORA-2026-A9EBA4BBC3 vom 2026-10-21","url":"https://bodhi.fedoraproject.org/updates/FEDORA-2026-a9eba4bbc3"},{"category":"external","summary":"Fedora Security Advisory FEDORA-2026-D5F8446449 vom 2026-10-21","url":"https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449"},{"category":"external","summary":"Gentoo Linux Security Advisory GLSA-202610-02 vom 2026-10-21","url":"https://bugs.gentoo.org/984631"},{"category":"external","summary":"PHP Security Advisory vom 2026-10-21","url":"https://www.php.net/archive/2026.php#2026-10-21-5"}],"source_lang":"en-US","title":"PHP: Mehrere Schwachstellen ermöglichen Codeausführung","tracking":{"current_release_date":"2026-10-21T22:00:00.000+00:00","generator":{"date":"2026-10-22T06:35:54.572+00:00","engine":{"name":"BSI-WID","version":"1.6.0"}},"id":"WID-SEC-W-2026-4055","initial_release_date":"2026-10-20T22:00:00.000+00:00","revision_history":[{"date":"2026-10-20T22:00:00.000+00:00","number":"1","summary":"Initiale Fassung"},{"date":"2026-10-21T22:00:00.000+00:00","number":"2","summary":"Neue Updates von Arch Linux, European Union Vulnerability Database, tribe29, Google, Rocky Enterprise Software Foundation, Oracle Linux, SUSE, Debian, F5, Ubuntu, Red Hat, Amazon, Fedora und Gentoo aufgenommen"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"category":"product_name","name":"Amazon Linux 2","product":{"name":"Amazon Linux 2","product_id":"398363","product_identification_helper":{"cpe":"cpe:/o:amazon:linux_2:-"}}}],"category":"vendor","name":"Amazon"},{"branches":[{"branches":[{"category":"product_version_range","name":"<2.4.0p38","product":{"name":"Checkmk Checkmk <2.4.0p38","product_id":"T060647"}},{"category":"product_version","name":"2.4.0p38","product":{"name":"Checkmk Checkmk 2.4.0p38","product_id":"T060647-fixed","product_identification_helper":{"cpe":"cpe:/a:checkmk:checkmk:2.4.0p38"}}},{"category":"product_version_range","name":"<2.3.0p51","product":{"name":"Checkmk Checkmk <2.3.0p51","product_id":"T060648"}},{"category":"product_version","name":"2.3.0p51","product":{"name":"Checkmk Checkmk 2.3.0p51","product_id":"T060648-fixed","product_identification_helper":{"cpe":"cpe:/a:checkmk:checkmk:2.3.0p51"}}},{"category":"product_version_range","name":"<2.5.0p17","product":{"name":"Checkmk Checkmk <2.5.0p17","product_id":"T061595"}},{"category":"product_version","name":"2.5.0p17","product":{"name":"Checkmk Checkmk 2.5.0p17","product_id":"T061595-fixed","product_identification_helper":{"cpe":"cpe:/a:checkmk:checkmk:2.5.0p17"}}}],"category":"product_name","name":"Checkmk"}],"category":"vendor","name":"Checkmk"},{"branches":[{"category":"product_name","name":"Debian Linux","product":{"name":"Debian Linux","product_id":"2951","product_identification_helper":{"cpe":"cpe:/o:debian:debian_linux:-"}}}],"category":"vendor","name":"Debian"},{"branches":[{"category":"product_name","name":"F5 BIG-IP","product":{"name":"F5 BIG-IP","product_id":"T054135","product_identification_helper":{"cpe":"cpe:/a:f5:big-ip:-"}}}],"category":"vendor","name":"F5"},{"branches":[{"category":"product_name","name":"Fedora Linux","product":{"name":"Fedora Linux","product_id":"74178","product_identification_helper":{"cpe":"cpe:/o:fedoraproject:fedora:-"}}}],"category":"vendor","name":"Fedora"},{"branches":[{"category":"product_name","name":"Gentoo Linux","product":{"name":"Gentoo Linux","product_id":"T033788","product_identification_helper":{"cpe":"cpe:/o:gentoo:linux:-"}}}],"category":"vendor","name":"Gentoo"},{"branches":[{"category":"product_name","name":"Google Cloud Platform","product":{"name":"Google Cloud Platform","product_id":"393401","product_identification_helper":{"cpe":"cpe:/a:google:cloud_platform:-"}}}],"category":"vendor","name":"Google"},{"branches":[{"category":"product_name","name":"Open Source Arch Linux","product":{"name":"Open Source Arch Linux","product_id":"T033780","product_identification_helper":{"cpe":"cpe:/o:archlinux:archlinux:-"}}},{"branches":[{"category":"product_version_range","name":"<5.14.2","product":{"name":"Open Source Matomo <5.14.2","product_id":"T061596"}},{"category":"product_version","name":"5.14.2","product":{"name":"Open Source Matomo 5.14.2","product_id":"T061596-fixed","product_identification_helper":{"cpe":"cpe:/a:matomo:matomo:5.14.2"}}}],"category":"product_name","name":"Matomo"},{"branches":[{"category":"product_name","name":"Open Source PHP","product":{"name":"Open Source PHP","product_id":"8746","product_identification_helper":{"cpe":"cpe:/a:php:php:-"}}},{"category":"product_version_range","name":"<8.2.35","product":{"name":"Open Source PHP <8.2.35","product_id":"T061597"}},{"category":"product_version","name":"8.2.35","product":{"name":"Open Source PHP 8.2.35","product_id":"T061597-fixed","product_identification_helper":{"cpe":"cpe:/a:php:php:8.2.35"}}},{"category":"product_version_range","name":"<8.3.36","product":{"name":"Open Source PHP <8.3.36","product_id":"T061598"}},{"category":"product_version","name":"8.3.36","product":{"name":"Open Source PHP 8.3.36","product_id":"T061598-fixed","product_identification_helper":{"cpe":"cpe:/a:php:php:8.3.36"}}},{"category":"product_version_range","name":"<8.4.27","product":{"name":"Open Source PHP <8.4.27","product_id":"T061599"}},{"category":"product_version","name":"8.4.27","product":{"name":"Open Source PHP 8.4.27","product_id":"T061599-fixed","product_identification_helper":{"cpe":"cpe:/a:php:php:8.4.27"}}},{"category":"product_version_range","name":"<8.5.12","product":{"name":"Open Source PHP <8.5.12","product_id":"T061600"}},{"category":"product_version","name":"8.5.12","product":{"name":"Open Source PHP 8.5.12","product_id":"T061600-fixed","product_identification_helper":{"cpe":"cpe:/a:php:php:8.5.12"}}},{"category":"product_version","name":"5","product":{"name":"Open Source PHP 5","product_id":"T061603","product_identification_helper":{"cpe":"cpe:/a:php:php:5"}}},{"category":"product_version","name":"7","product":{"name":"Open Source PHP 7","product_id":"T061604","product_identification_helper":{"cpe":"cpe:/a:php:php:7"}}}],"category":"product_name","name":"PHP"}],"category":"vendor","name":"Open Source"},{"branches":[{"category":"product_name","name":"Oracle Linux","product":{"name":"Oracle Linux","product_id":"T056236","product_identification_helper":{"cpe":"cpe:/o:oracle:linux:-"}}}],"category":"vendor","name":"Oracle"},{"branches":[{"category":"product_name","name":"RESF Rocky Linux","product":{"name":"RESF Rocky Linux","product_id":"T054581","product_identification_helper":{"cpe":"cpe:/o:resf:rocky_linux:-"}}}],"category":"vendor","name":"RESF"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux","product":{"name":"Red Hat Enterprise Linux","product_id":"67646","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:-"}}}],"category":"vendor","name":"Red Hat"},{"branches":[{"category":"product_name","name":"SUSE Linux","product":{"name":"SUSE Linux","product_id":"T054646","product_identification_helper":{"cpe":"cpe:/o:suse:suse_linux:-"}}}],"category":"vendor","name":"SUSE"},{"branches":[{"category":"product_name","name":"Ubuntu Linux","product":{"name":"Ubuntu Linux","product_id":"T055947","product_identification_helper":{"cpe":"cpe:/o:canonical:ubuntu_linux:-"}}}],"category":"vendor","name":"Ubuntu"},{"branches":[{"category":"product_name","name":"cPanel cPanel/WHM","product":{"name":"cPanel cPanel/WHM","product_id":"T054177","product_identification_helper":{"cpe":"cpe:/a:cpanel:cpanel_whm:-"}}}],"category":"vendor","name":"cPanel"}]},"vulnerabilities":[{"cve":"CVE-2026-109618","product_status":{"known_affected":["T056236","T060647","T033788","T054177","T054581","67646","T061603","T061604","T060648","T033780","74178","393401","T054646","T054135","2951","T055947","T061597","T061598","398363","T061599","8746","T061600","T061595","T061596"]},"release_date":"2026-10-20T22:00:00.000+00:00","title":"CVE-2026-109618"},{"cve":"CVE-2026-109619","product_status":{"known_affected":["T056236","T060647","T033788","T054177","T054581","67646","T061603","T061604","T060648","T033780","74178","393401","T054646","T054135","2951","T055947","T061597","T061598","398363","T061599","8746","T061600","T061595","T061596"]},"release_date":"2026-10-20T22:00:00.000+00:00","title":"CVE-2026-109619"}]}