Linux · Oracle Linux · Security advisory · November 7, 2026

ELSA-2026-87080: Security update for 37 packages

ELSA-2026-87080, released November 7, 2026, fixes 12 CVEs across 37 products. 2 of them are being exploited (CVE-2026-109618); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV
CVEs closed
12
2 rated Critical
Exploited
2
CVE-2026-109618
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
1.0000
99th percentile

Priority of the 12 CVEs

Patch now 2 Urgent 0 High 10 Routine 0

Fixed package versions

ProductReleaseFixed in
apcu-panelol 80:5.1.18-1.module+el8.10.0+90472+f810484b
libzipol 80:1.6.1-1.module+el8.10.0+90472+f810484b
libzip-develol 80:1.6.1-1.module+el8.10.0+90472+f810484b
libzip-toolsol 80:1.6.1-1.module+el8.10.0+90472+f810484b
phpol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-bcmathol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-cliol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-commonol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-dbaol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-dbgol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-develol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-embeddedol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-enchantol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-ffiol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-fpmol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-gdol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-gmpol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-intlol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-jsonol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-ldapol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-mbstringol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-mysqlndol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-odbcol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-opcacheol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-pdool 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-pearol 81:1.10.13-1.module+el8.10.0+90472+f810484b
php-pecl-apcuol 80:5.1.18-1.module+el8.10.0+90472+f810484b
php-pecl-apcu-develol 80:5.1.18-1.module+el8.10.0+90472+f810484b
php-pecl-rrdol 80:2.0.1-1.module+el8.10.0+90472+f810484b
php-pecl-xdebugol 80:2.9.5-1.module+el8.10.0+90472+f810484b
php-pecl-zipol 80:1.18.2-1.module+el8.10.0+90472+f810484b
php-pgsqlol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-processol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-snmpol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-soapol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-xmlol 80:7.4.33-8.module+el8.10.0+91080+9785160d
php-xmlrpcol 80:7.4.33-8.module+el8.10.0+91080+9785160d

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2026-109618 apache2-mod_php7: CVE-2026-109619: memory corruption leading to RCE (bsc#1286027).9.8 1.0000 KEVExploited
Patch now CVE-2026-109619 apache2-mod_php7: CVE-2026-109618, memory corruption leading to RCE (bsc#1286027).8.1 1.0000 KEVExploited
High CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node8.1 0.0038 None reported
High CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)8.1 0.0038 None reported
High CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header8.1 0.0034 None reported
High CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing8.1 0.0031 None reported
High CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects8.1 0.0029 None reported
High CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c8.1 0.0028 None reported
High CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL8.1 0.0028 None reported
High CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection8.1 0.0016 None reported
High CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch8.1 0.0016 None reported
High CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN8.1 0.0011 None reported
Showing 1 to 12 of 12 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.