PHP security releases of September 2026: 8.5.11, 8.4.26, 8.3.35 and 8.2.34 fix 11 CVEs

On 24 September 2026 the PHP project released PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34 as security releases. Every branch received the same 11 CVE fixes. Many of them concern PHP acting as a client: following HTTP redirects, checking TLS certificates, and talking to MySQL or SOAP servers. Others affect servers directly: a SOAP endpoint crash and an access-control bypass in PHP-FPM.

At a glance

What the vulnerabilities are

Server-side issues

• CVE-2026-91765 (GHSA-rgrp-mwpx-f6rm, High, CVSS 3.1 7.5): the SOAP XML parser recursed once per nesting level with no limit, so an unauthenticated attacker can post a deeply nested request to any SoapServer endpoint and crash the process.
• CVE-2026-91768 (Medium, CVSS 3.1 6.5): PHP-FPM's listen.allowed_clients check compared only the first 12 bytes of an IPv6 address, so it matched a whole /96 prefix instead of one address. A host sharing the first 96 bits with an allowed address could reach the FastCGI port.

PHP as an HTTP and TLS client

• CVE-2026-91766 (Medium, 5.9): when the http:// stream wrapper followed a redirect, it forwarded user-supplied Authorization, Cookie and Proxy-Authorization headers to a different host or port, or over a downgrade from HTTPS to HTTP.
• CVE-2026-93682 (Medium): a redirect with an empty Location header caused a one-byte over-read that decided where the client was sent next.
• CVE-2026-91769 (Medium, 4.3): TLS peer verification fell back to the certificate's Common Name after a subjectAltName mismatch, contrary to RFC 6125, so a certificate trusted for one name could be used to impersonate another.
• CVE-2026-91767 (Medium, 6.5): a server certificate with a crafted wildcard name could make the client read far past a heap buffer during hostname checks, with denial of service as the stated impact.

Other clients, archives and filters

• CVE-2025-14181 (Medium, 6.5): the SOAP HTTP client's buffer growth check relied on signed integer overflow, so a malicious SOAP server could cause a heap buffer overflow, depending on compiler and heap layout.
• CVE-2025-1218 (Low, 3.4): mysqlnd read past packet buffers when a malicious or compromised MySQL server sent truncated packets. Applications that only connect to trusted database servers are not exposed, as Debian notes.
• CVE-2026-6103 (Medium, 4.3): an integer overflow in the phar TAR parser let a crafted archive inject entries that PharData reports and extracts as genuine.
• CVE-2026-92842 (Medium, 5.9): the convert.* stream filters could leak heap bytes into their output when line-break-chars contained a NUL byte.
• CVE-2026-17545 (Medium, CVSS 4.0 6.9, Windows only): reserved device names such as CON or NUL in paths were not rejected, which can hang requests and exhaust workers.
• GHSA-ch8v-r6jh-4vvr (Low): FILTER_SANITIZE_ENCODED read an uninitialised table entry for byte 0xFF. 8.4 and 8.5 had already received this in 8.4.25 and 8.5.10 on 27 August.

None of these CVEs is in CISA's Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

Upstream builds older than 8.5.11, 8.4.26, 8.3.35 or 8.2.34 are affected. Also check whether you rely on FPM IPv6 allow-lists or expose SOAP servers:

php -v
grep -R 'listen.allowed_clients' /etc/php/*/fpm/pool.d/
php -m | grep -i soap

On Debian, compare with DSA-6514-1 (trixie) and DLA-4819-1 (bookworm):

apt policy php8.4-fpm php8.4-cli   # trixie: fixed in 8.4.26-1~deb13u1
apt policy php8.2-fpm php8.2-cli   # bookworm: fixed in 8.2.34-1~deb12u1

Ubuntu users should check Ubuntu Security Notices.

How to update

Run sudo apt update and sudo apt upgrade on Debian or Ubuntu. For source, Windows and container builds, install the newest release of your branch from php.net/downloads. Less than a month later, on 21-22 October 2026, PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with fixes for two critical flaws that CISA has listed as known exploited since 26 October 2026, so update straight to those.

Restart or reboot?

No reboot. Restart PHP-FPM, Apache (mod_php) and long-running PHP workers:

sudo systemctl restart php8.4-fpm   # or php8.2-fpm on bookworm

Sources

• php.net/releases/8_4_26.php
• php.net/releases/8_3_35.php
• php.net/releases/8_2_34.php
• php.net/archive/2026.php
• php.net/ChangeLog-8.php#8.5.11
• php.net/ChangeLog-8.php#8.2.34
• github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm
• github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637
• github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92
• github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f
• github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx
• github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p
• github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv
• github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7
• github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85
• github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6
• github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp
• github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr
• cve.org/CVERecord?id=CVE-2026-91765
• cve.org/CVERecord?id=CVE-2026-91768
• security-tracker.debian.org/tracker/DSA-6514-1
• lists.debian.org/debian-security-announce/2026/msg00427.html
• security-tracker.debian.org/tracker/DLA-4819-1
• lists.debian.org/debian-lts-announce/2026/10/msg00011.html
• cisa.gov/known-exploited-vulnerabilities-catalog