PHP ships security releases on four branches, fixing five CVEs
Victoria Shinder2 min readThe PHP project released versions 8.5.11, 8.4.26, 8.3.35 and 8.2.34 on 24 September. The 8.5.11 changelog lists five security advisories among its fixes, and they touch parts of PHP that run in almost every deployment: the FastCGI process manager, TLS, and archive handling.
The advisories are specific. CVE-2026-91768 fixes an IPv6 allow-list bypass in PHP-FPM's listen.allowed_clients, caused by comparing only part of an address. CVE-2026-91769 stops TLS hostname verification from falling back to the certificate's common name after a subject alternative name mismatch. CVE-2026-91767 fixes a heap buffer overflow when matching a crafted wildcard common name in a server certificate. CVE-2026-6103 fixes an integer overflow in the TAR parser for phar archives that allowed entries to be injected, and CVE-2025-1218 addresses packet over-reads in the mysqlnd wire protocol. The same release carries a long list of ordinary fixes, including several use-after-free bugs in the DOM and Intl extensions and two generator bugs with nested yield from.
PHP 8.2 and 8.3 are in their security-only phase, so their releases exist for exactly this kind of list; 8.4 and 8.5 are in active support and ship bug fixes as well.
What it means
Two of these fixes are about who a server trusts. The FPM allow-list bypass matters wherever listen.allowed_clients is the control that keeps a FastCGI port reachable only from the web server, and IPv6 is enabled. The TLS change closes a fallback that let a certificate be accepted on its common name after the subject alternative name had already failed to match - the kind of leniency modern TLS clients removed years ago. The changelog files both TLS fixes under the OpenSSL extension, so the likely exposure is code that opens TLS connections through PHP's own OpenSSL streams rather than through cURL.
The practical step is to move every PHP runtime to the matching patch release, including container base images that pin a PHP minor version and are rebuilt rarely. For services that cannot be updated immediately, restricting the FastCGI socket at the network level rather than relying on listen.allowed_clients alone removes the most exposed of the five.