Red Hat Security Advisory: php8.4 security update

CVE-2026-6104 — php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding CVE-2026-6735 — PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation CVE-2026-7258 — PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7262 — php: NULL pointer dereference in SOAP apache:Map decoder with missing CVE-2026-7263 — php: denial of service via DOMNode::C14N() CVE-2026-7568 — php: signed integer overflow in metaphone()