Security Bulletin: IBM QRadar SIEM contains PHP components with known vulnerabilities

Workarounds and Mitigations

QRadar Hotfix Installation Instructions

Fix 1 - Applies to:
• QRadar SIEM deployments without QRadar Incident Forensics.
• QRadar versions 7.5.0 Update Pack 8 (UP8) and later OR 7.6.0.0 and later.

Important: Do not apply this hotfix to deployments that include QRadar Incident Forensics, see Fix 2 below for QRadar Incident Forensics.. 

Important: Customer with HA should re-run the new mitigation to ensure it is applied to secondary. Prior to 2026-10-23 1245 UTC, HotFix version QRADAR-QRSIEM-202610221930INT-HF did not automatically apply these mitigations to Secondary hosts in a High Availability (HA) environment. Hotfix version QRADAR-QRSIEM-202610231930INT-HF now automatically applies to secondaries. - Updated 2026-10-23. The hotfix installer automatically applies the hotfix to the Console and all managed hosts in the deployment including High Availability host.

Important: Customers running in FIPS enabled mode should apply the workaround in https://www.ibm.com/mysupport/s/defect/aCIKe00000003a2OAA/dt395621?language=en_US to install this hotfix

Installing the Hotfix for non-QIF deployments
1. Download the hotfix package from IBM Fix Central.
2. Copy the hotfix file to your QRadar Console to the  /store/ibm_support/ directory and navigate to that directory
cd /store/ibm_support/
3. Extract the package:.
tar -xzvf QRADAR-QRSIEM-202610231930INT-HF.tgz
4. Change to the extracted directory:
cd QRADAR-36266-hotfix-non-QIF
5. Install the hotfix by running:
./install.sh
6. The installer will report successful, or display an error detailing the issues encountered.
7. For further validation, you may run the following commands to validate the mitigation

/opt/qradar/support/all_servers.sh -Ck 'if rpm -qa | grep -q php81; then echo "ERROR: There was an error removing vulnerable php rpms"; else echo "INFO: vulnerable php rpms were removed successfully"; fi'

/opt/qradar/support/all_servers.sh -Ck 'if [ "$(rpm -qa | grep -c php82)" -ne 16 ]; then echo "ERROR: There was an Error installing new php rpms"; else echo "INFO: New php rpms were Successfully installed"; fi'

/opt/qradar/support/all_servers.sh -Ck 'if grep LoadModule /etc/httpd/conf/httpd.conf | grep php_module | grep -q 81; then echo "ERROR: There was an error updating php config"; else echo "INFO: php config was updated successfully"; fi' 

Additional Information
• The installer automatically applies the hotfix to the Console and all managed hosts in the deployment.
• No manual installation is required on managed hosts.

Upgrade Considerations
Important: If you upgrade QRadar after applying this hotfix, the hotfix may be overwritten by the upgrade process. After the upgrade completes, reapply the hotfix to ensure the fix remains in place.

Fix 2 - Applies to:
• QRadar SIEM deployments QRadar Incident Forensics running QRadar SIEM 7.5.0 UP16
• Any Interim Fix (IF) on 7.5.0 UP16 (IF01, IF02)

Important: Customer with HA should re-run the new mitigation to ensure it is applied to secondary. Prior to 2026-10-23 1245 UTC, HotFix version hotfix-2021.6.16.20260817115410-QIF-HF did not automatically apply these mitigations to Secondary hosts in a High Availability (HA) environment. Hotfix version 7.5.0-QRADAR-QIF-202610221930-202610231930INT-HF now automatically applies to secondaries. -Updated 2026-10-23

Important: Customers running in FIPS enabled mode should apply the workaround in https://www.ibm.com/mysupport/s/defect/aCIKe00000003a2OAA/dt395621?language=en_US to install this hotfix

Installing the Hotfix for QIF Deployments
1. Download the hotfix package from IBM Fix Central.
2. Copy the hotfix file to your QRadar Console to the  /store/ibm_support/ directory and navigate to that directory
cd /store/ibm_support/
3. Extract the package:.
tar -xzvf hotfix-2021.6.16.20260817115410-QIF-202610231930INT-HF.tar.gz
4. Change to the extracted directory:
cd hotfix-2021.6.16.20260817115410-QIF-202610231930INT-HF
5. Install the hotfix by running:
./install.sh

6.Now Login to QIF box and go to /storetmp/ folder and run following command only on QIF box and restart the httpd-qif service:
systemctl restart httpd-qif

7. For further validation, you may run the following commands to validate the mitigation

/opt/qradar/support/all_servers.sh -Ck 'if rpm -qa | grep -q php81; then echo "ERROR: There was an error removing vulnerable php rpms"; else echo "INFO: vulnerable php rpms were removed successfully"; fi'

/opt/qradar/support/all_servers.sh -Ck 'if [ "$(rpm -qa | grep -c php82)" -ne 16 ]; then echo "ERROR: There was an Error installing new php rpms"; else echo "INFO: New php rpms were Successfully installed"; fi'

/opt/qradar/support/all_servers.sh -Ck 'if grep LoadModule /etc/httpd/conf/httpd.conf | grep php_module | grep -q 81; then echo "ERROR: There was an error updating php config"; else echo "INFO: php config was updated successfully"; fi' 

Additional Information
• The installer automatically applies the hotfix to the Console and all managed hosts in the deployment.
• No manual installation is required on managed hosts.

Upgrade Considerations
Important: If you upgrade QRadar after applying this hotfix, the hotfix may be overwritten by the upgrade process. After the upgrade completes, reapply the hotfix to ensure the fix remains in place.