Back Linuxsecurity

Fedora 43 PHP 8.4.21 Important Bug Fixes CVE-2026-7262 2026

Linuxsecurity •LinuxSecurity Advisories • May 15, 2026

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Update Information : PHP version 8.4.21 (07 May 2026) Core: Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors). (iliaal) Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies). (iliaal) Fixed bug GH-21605 (Missing addref for Countable::count()). (ilutov) Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws). (macoaure) Fixed bug GH-21603 (Missing addref for __unset). (ilutov) Fixed bug GH-21760 (Trait with class constant name conflict against enum case causes SEGV). (Pratik Bhujel) CLI: Fixed bug GH-21754 (--rf command line option with a method triggers ext/reflection deprecation warnings). (DanielEScherzer) Curl: Add support for brotli and zstd on Windows. (Shivam Mathur) DOM: Fixed GHSA-4jhr-8w89-j733 and GH-21566 (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263) (David Carlier) ...

PHP is an HTML-embedded scripting language. PHP attempts to make it

easy for developers to write dynamically generated web pages. PHP also

offers built-in database integration for several commercial and

non-commercial database management systems, so writing a

database-enabled webpage with PHP is fairly simple. The most common

use of PHP coding is probably as a replacement for CGI scripts.

PHP version 8.4.21 (07 May 2026) Core: Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors). (iliaal) Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies). (iliaal) Fixed bug GH-21605 (Missing addref for Countable::count()). (ilutov) Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws). (macoaure) Fixed bug GH-21603 (Missing addref for __unset). (ilutov) Fixed bug GH-21760 (Trait with class constant name conflict against enum case causes SEGV). (Pratik Bhujel) CLI: Fixed bug GH-21754 (--rf command line option with a method triggers ext/reflection deprecation warnings). (DanielEScherzer) Curl: Add support for brotli and zstd on Windows. (Shivam Mathur) DOM: Fixed GHSA-4jhr-8w89-j733 and GH-21566 (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263) (David Carlier) ...

* Wed May 6 2026 Remi Collet - 8.4.21-1 - Update to 8.4.21 -

Fedora Update Notification FEDORA-2026-c4d1ca4f16 2026-05-15 03:06:23.642297+00:00 Name : php Product : Fedora 43 Version : 8.4.21 Release : 1.fc43 URL : Summary : PHP scripting language for creating dynamic web sites Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-c4d1ca4f16' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Bug Fixes for PHP 8.4.21 in Fedora 43 and 42 On May 10, 2026, two critical vulnerabilities were published affecting PHP 8.4.21, specifically CVE-2026-7262 and CVE-2026-7263. These vulnerabilities impact Fedora versions 42 and 43, which utilize PHP for web development. The issues include assertion failures and memory management errors that could lead to application crashes or unexpected behavior. Users are advised to update to the latest PHP version to mitigate these vulnerabilities. The updates were released on May 6, 2026, but the advisories were published on May 14 and 15, 2026. PHP is widely used for dynamic web page generation, making these vulnerabilities significant for many web applications. The current status is that patches are available, and users are encouraged to apply them promptly. 2 sources 58

Extracted Entities

CVEs (2)

CVE-2026-7262 CVE-2026-7263