[8.0.30-8.1] - Fix FILTER_SANITIZE_ENCODED does not encode 0xFF - Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison CVE-2026-91768 - Fix Various packet overreads in mysqlnd wire protocol CVE-2025-1218 - Fix TLS hostname verification falls back to CN after SAN mismatch CVE-2026-91769 - Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN CVE-2026-91767 - Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection CVE-2026-6103 - Fix Unbounded recursion in server-side cleanup_xml_node() CVE-2026-91765 - Fix Integer overflow to buffer overflow in SOAP HTTP parsing CVE-2025-14181 - Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL CVE-2026-92842 - Fix Cross-origin credential leak in HTTP stream wrapper redirects CVE-2026-91766 - Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header CVE-2026-93682 - Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619
Last supporting evidence check: 2026-10-24T09:15:45.622Z UTC
php 8.0.30-8.el9_8.1
php-bcmath 8.0.30-8.el9_8.1
php-cli 8.0.30-8.el9_8.1
php-common 8.0.30-8.el9_8.1
php-dba 8.0.30-8.el9_8.1
php-dbg 8.0.30-8.el9_8.1
php-devel 8.0.30-8.el9_8.1
php-embedded 8.0.30-8.el9_8.1
php-enchant 8.0.30-8.el9_8.1
php-ffi 8.0.30-8.el9_8.1
php-fpm 8.0.30-8.el9_8.1
php-gd 8.0.30-8.el9_8.1
php-gmp 8.0.30-8.el9_8.1
php-intl 8.0.30-8.el9_8.1
php-ldap 8.0.30-8.el9_8.1
php-mbstring 8.0.30-8.el9_8.1
php-mysqlnd 8.0.30-8.el9_8.1
php-odbc 8.0.30-8.el9_8.1
php-opcache 8.0.30-8.el9_8.1
php-pdo 8.0.30-8.el9_8.1
php-pgsql 8.0.30-8.el9_8.1
php-process 8.0.30-8.el9_8.1
php-snmp 8.0.30-8.el9_8.1
php-soap 8.0.30-8.el9_8.1
php-xml 8.0.30-8.el9_8.1