PHP security releases of 2 July 2026: 8.5.8, 8.4.23, 8.3.32 and 8.2.32 (AES key wrap fix)

On 2 July 2026 the PHP project released PHP 8.5.8, 8.4.23, 8.3.32 and 8.2.32 as security releases (the 8.4.23 ChangeLog entry is dated 3 July). Every branch received a fix for a memory corruption bug in the OpenSSL extension's AES key wrap with padding mode. The 8.3 branch also received a TLS-related crash fix that 8.4 and 8.5 had already received in May.

At a glance

What the vulnerabilities are

CVE-2026-14355: AES-WRAP-PAD buffer sizing (all branches)

When openssl_encrypt() uses AES key wrap with padding (RFC 5649), PHP sized the output buffer from the plaintext length without allowing for the expansion that key wrapping adds. According to the CVE record, OpenSSL may then write beyond the allocated memory, corrupting heap metadata and triggering an application abort. The ChangeLog tracks it as bug GH-22187 ("zend_mm_heap corrupted" in openssl_encrypt with AES-WRAP-PAD). The CVE record, published by PHP as CNA, scores it CVSS 3.1 5.6 (Medium). Debian describes the result as memory corruption. Only code that actually uses the key-wrap-with-padding ciphers reaches this path.

CVE-2026-12184: crash when TLS setup fails (PHP 8.3)

PHP's advisory GHSA-mhmq-mmqj-2v39 (High, CVSS 4.0 8.2) explains that when the HTTP stream wrapper fails to set up TLS, for example because of a peer name mismatch or an expired certificate, a cleanup step used a stream that had already been closed. A remote server can trigger it without specially crafted PHP code, and the advisory says the impact is a remotely triggered denial of service that brings down the FPM process with all its workers. It was fixed for 8.4 and 8.5 on 7 May 2026 and for 8.3 in 8.3.32. PHP 8.2 is not affected, according to Debian's tracker.

Neither CVE is in CISA's Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

Check the PHP version and whether your code uses the key-wrap-with-padding ciphers:

php -v
grep -rniE 'wrap-pad' /var/www 2>/dev/null | head

Upstream builds older than 8.5.8, 8.4.23, 8.3.32 or 8.2.32 lack the CVE-2026-14355 fix. On Debian, compare with DSA-6377-1 for Debian 13 (trixie) and DLA-4669-1 for Debian 12 (bookworm), which now receives PHP fixes from the Debian LTS team:

apt policy php8.4-fpm php8.4-cli   # trixie: fixed in 8.4.23-1~deb13u1
apt policy php8.2-fpm php8.2-cli   # bookworm: fixed in 8.2.32-1~deb12u1

Ubuntu users should check Ubuntu Security Notices.

How to update

On Debian and Ubuntu run sudo apt update and sudo apt upgrade. For source, Windows and container builds, install the newest release of your branch from php.net/downloads. These July versions are already superseded: as of 31 October 2026 the current releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Restart or reboot?

No reboot is needed. Restart PHP-FPM and Apache (mod_php) so the workers load the new code, plus any long-running PHP workers:

sudo systemctl restart php8.4-fpm   # or php8.2-fpm on bookworm

Sources

• php.net/archive/2026.php
• php.net/ChangeLog-8.php#8.5.8
• php.net/ChangeLog-8.php#8.3.32
• github.com/php/php-src/issues/22187
• cve.org/CVERecord?id=CVE-2026-14355
• nvd.nist.gov/vuln/detail/CVE-2026-14355
• github.com/php/php-src/security/advisories/GHSA-mhmq-mmqj-2v39
• security-tracker.debian.org/tracker/CVE-2026-12184
• security-tracker.debian.org/tracker/DSA-6377-1
• lists.debian.org/debian-security-announce/2026/msg00288.html
• security-tracker.debian.org/tracker/DLA-4669-1
• lists.debian.org/debian-lts-announce/2026/07/msg00010.html
• cisa.gov/known-exploited-vulnerabilities-catalog