High-Severity PHP Vulnerabilities Patched Across Multiple Branches

TL;DR

The PHP development team released security updates resolving ten distinct security flaws. These PHP vulnerabilities affect core modules, including FastCGI process management, SOAP parsing, and TLS validation. System administrators must upgrade their PHP installations immediately to prevent denial of service and credential leakage.

Notable CVEs

Why It Matters

PHP powers over 75 percent of all web applications with known server-side languages. Consequently, security defects in the runtime engine affect millions of internet-facing servers. The vulnerabilities in this batch carry CVSS scores ranging from 4.0 to 7.5.

Attackers can exploit several flaws remotely without providing valid user credentials. For instance, stream wrapper flaws can leak sensitive session cookies or tokens across different origins. Additionally, improper input handling in SOAP components allows attackers to crash worker pools. Fortunately, security teams have confirmed no active exploitation in the wild. While researchers produced proof-of-concept tests during verification, attackers have not weaponized these defects in active campaigns. Nevertheless, leaving internet-facing environments unpatched exposes web applications to remote disruption. Therefore, addressing these PHP vulnerabilities remains essential for operational security.

How The Attacks Work

The security bulletin details weaknesses across network communication, XML processing, and memory management.

FastCGI Access Control Bypass

The flaw tracked as CVE-2026-91768 undermines network restrictions in PHP-FPM. When evaluating IPv6 client connections, the access check only verifies the first 12 bytes of the address. The advisory notes, “An exact IPv6 comparison must cover all 16 bytes of struct in6_addr.” Consequently, the software matches on a /96 network prefix rather than the exact address. An attacker sharing the first 96 bits with an authorized client can bypass access controls. This mistake allows intruders to connect to FastCGI endpoints and execute arbitrary scripts.

Unbounded Recursion And Buffer Overflows In SOAP

Two dangerous flaws reside in the SOAP extension. First, CVE-2026-91765 introduces a denial of service risk. The advisory explains that “cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit.” An attacker can send deeply nested XML elements to exhaust stack memory. This action triggers an immediate segmentation fault that crashes PHP-FPM workers.

Second, CVE-2025-14181 involves integer handling during HTTP response parsing. The code relied on signed integer overflow to detect large HTTP bodies. Compilers frequently optimize away this undefined check. When an attacker sends crafted chunked responses, the client allocates a small heap buffer and overwrites adjacent memory.

Stream Wrapper Leaks And Memory Flaws

The HTTP stream wrapper contains two notable defects. Under CVE-2026-91766, PHP forwards authentication headers across domain redirects. If a request redirects to a malicious server, the client reveals session cookies and bearer tokens. Meanwhile, CVE-2026-93682 causes an out-of-bounds read during HTTP redirects. As the advisory states, “the redirect code reads one byte past the end of the heap buffer holding the location.”

Furthermore, CVE-2026-91767 impacts TLS certificate verification. When verifying wildcard server names, the function underflows length calculations. A malicious server presenting a long wildcard certificate forces the client to read past heap boundaries. In addition, CVE-2026-91769 incorrectly falls back to Common Name verification after Subject Alternative Name mismatches.

Windows Device Names And Archive Parsing

On Windows, CVE-2026-17545 allows attackers to pass reserved device names such as CON or NUL into filesystem functions. This action opens character devices and hangs worker threads. Additionally, CVE-2026-6103 involves an integer overflow in the TAR parser of the Phar extension. An attacker can craft an archive size header that wraps around zero. This flaw tricks the parser into reading user content as genuine file entries. Finally, CVE-2026-92842 leaks heap memory in stream filters when line-break characters contain embedded NUL bytes.

Affected Versions

These PHP vulnerabilities impact multiple active and maintenance branches. Specifically, the issues affect PHP versions prior to 8.2.34, 8.3.35, 8.4.26, and 8.5.11. Installations running legacy, unsupported PHP versions also remain exposed to these mechanisms.

Patch Or Mitigation Steps

System administrators must update their environments to patched releases immediately. The core team released versions 8.2.34, 8.3.35, 8.4.26, and 8.5.11 to remediate all ten flaws. You can review the complete advisories in the PHP security advisories repository on GitHub.

Administrators should download verified binary distributions and source packages from the official PHP downloads portal. If you cannot update immediately, apply targeted network mitigations. For example, bind PHP-FPM to Unix domain sockets rather than IPv6 TCP ports. In addition, restrict outbound HTTP stream requests and place SOAP endpoints behind web application firewalls. Resolving these PHP vulnerabilities ensures stable, secure operations across enterprise web applications.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.