| Package | php7.4 |
|---|---|
| Version | 7.4.33-1+deb11u14 (bullseye) |
| Related CVEs | CVE-2026-109618 CVE-2026-109619 |
Two critical vulnerabilities were found in PHP, a widely-used open source general purpose scripting language, which could result in remote execution of arbitrary code.
CVE-2026-109618
Out-of-memory handling can interrupt PHP while internal request data
is only partially initialized. Request cleanup may then treat the
invalid data as valid.
CVE-2026-109619
Request-owned internal global state can survive after its backing
memory has been freed. A later request handled by the same worker
may use that stale state before normal initialization resets it.
For Debian 11 bullseye, these problems have been fixed in version 7.4.33-1+deb11u14.
We recommend that you upgrade your php7.4 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.