CVE-2026-6103

Severity: Moderate

Published: 2026-09-25

php8.4 - security update

Exploit evidence

Public proof of concept reported

Last checked: 2026-09-29 22:54 UTC

Proof of concept · CISA Coordinator (Assessed 2026-09-25 20:41 UTC)

NVD evidence for CVE-2026-6103 is reported, not independently verified by Package Alert. It does not establish exploit reliability or applicability to a particular package or environment.

References

Fix Status by Distribution

Fix evidence last checked: 2026-10-21 06:52 UTC

Fixed in:

Debian 12 (Bookworm)
- DLA-4819-1 · Published 2026-10-05
Debian 13 (Trixie)
- DSA-6514-1 · Published 2026-09-25
SUSE Linux Enterprise Server 15 SP5
- SUSE-SU-2026:4651 · Published 2026-10-13
SUSE Linux Enterprise Server 15 SP6
- SUSE-SU-2026:4603 · Published 2026-10-09
SUSE Linux Enterprise Server 15 SP7
- SUSE-SU-2026:4602 · Published 2026-10-09
SUSE Linux Enterprise Server 16
- SUSE-SU-2026:24158 · Published 2026-10-07
Ubuntu 22.04 LTS (Jammy Jellyfish)
- USN-8936-1 · Published 2026-10-19
Ubuntu 24.04 LTS (Noble Numbat)
- USN-8936-1 · Published 2026-10-19
Ubuntu 26.04 LTS (Resolute Raccoon)
- USN-8936-1 · Published 2026-10-19
Ubuntu 26.10 (Stonking Stingray)
- USN-8936-1 · Published 2026-10-19

No fix evidence found:

AlmaLinux 10

AlmaLinux 8

AlmaLinux 9

Debian 11 (Bullseye)

Oracle Linux 10

Oracle Linux 8

Oracle Linux 9

Red Hat Enterprise Linux 10

Red Hat Enterprise Linux 7 (Extended Lifecycle Support)

Red Hat Enterprise Linux 8

Red Hat Enterprise Linux 9

Rocky Linux 10

Rocky Linux 8

Rocky Linux 9

SUSE Linux Enterprise Server 12 SP5

Ubuntu 25.04 (Plucky Puffin)

Ubuntu 25.10 (Questing Quokka)

Interested in being alerted when these distributions have fixes? Set up an alert.