PHP security advisories

Latest release 8.5.12

2 advisories affect supported versions.

Supported branches

Branch	Latest safe version	Security support until
8.5	8.5.12	Dec 31, 2029
8.4	8.4.27	Dec 31, 2028
8.3	8.3.36	Dec 31, 2027
8.2	8.2.35	Dec 31, 2026

Check your version

Type the PHP version you run to see every security fix it's missing, and how long your branch is supported.

All PHP advisories

63 advisories, newest first.

critical Oct 21, 2026 CVE-2026-109618

RCE via OOM corruption

Update PHP to

8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35
critical Oct 21, 2026 CVE-2026-109619

RCE via stale global state

Update PHP to

8.5.x 8.5.12 8.4.x 8.4.27 8.3.x 8.3.36 8.2.x 8.2.35
medium Sep 24, 2026 CVE-2026-93682

Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2026-92842

OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
low Sep 24, 2026

ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

Update PHP to

8.5.x 8.5.10 8.4.x 8.4.25 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2026-91768

IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2026-91769

TLS Hostname Verification Falls Back to CN After SAN Mismatch

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2026-91767

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
low Sep 24, 2026 CVE-2025-1218

Various packet overreads in mysqlnd_writeprotocol.c

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2026-91766

Cross-origin credential leak in HTTP stream wrapper redirects

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
high Sep 24, 2026 CVE-2026-91765

SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2025-14181

Integer overflow to buffer overflow in soap HTTP parsing

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2026-6103

Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Sep 24, 2026 CVE-2026-17545

PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

Update PHP to

8.5.x 8.5.11 8.4.x 8.4.26 8.3.x 8.3.35 8.2.x 8.2.34
medium Jul 30, 2026 CVE-2026-7260

Stack overflow in phar with circular symlinks

Update PHP to

8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33
high Jul 30, 2026 CVE-2026-17544

Out-of-bounds write in bccomp() via crafted operand and scale

Update PHP to

8.5.x 8.5.9 8.4.x 8.4.24
high Jul 30, 2026 CVE-2026-17543

SQL injection in ext-pgsql via E'...' backslash breakout

Update PHP to

8.5.x 8.5.9 8.4.x 8.4.24 8.3.x 8.3.33 8.2.x 8.2.33
high Jul 2, 2026 CVE-2026-12184

Failure to setup TLS with a remote server can result in a remote DoS

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.32
medium Jul 2, 2026 CVE-2026-14355

ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD

Update PHP to

8.5.x 8.5.8 8.4.x 8.4.23 8.3.x 8.3.32 8.2.x 8.2.32
medium May 7, 2026 CVE-2026-7262

NULL pointer dereference in SOAP apache:Map decoder with missing <value>

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
medium May 7, 2026 CVE-2026-7261

SoapServer session-persisted object use-after-free via SOAP header fault

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
low May 7, 2026 CVE-2026-7259

Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
medium May 7, 2026 CVE-2026-6735

XSS within PHP-FPM status endpoint

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
high May 7, 2026 CVE-2026-6722

Use-After-Free in SOAP using Apache map with Remote Code Execution

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
medium May 7, 2026 CVE-2026-7258

Out-of-bounds read in urldecode()

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
medium May 7, 2026 CVE-2026-6104

Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21
high May 7, 2026 CVE-2025-14179

SQL injection in pdo_firebird via NUL bytes in quoted strings

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
low May 7, 2026 CVE-2026-7568

Signed integer overflow in metaphone()

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21 8.3.x 8.3.31 8.2.x 8.2.31
high May 7, 2026 CVE-2026-7263

DoS attack via DOMNode::C14N()

Update PHP to

8.5.x 8.5.6 8.4.x 8.4.21
low Dec 18, 2025

Null byte termination in dns_get_record()

Update PHP to

8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30

+ 1 older release
medium Dec 18, 2025 CVE-2025-14180

NULL Pointer Dereference in PDO quoting

Update PHP to

8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30

+ 1 older release
medium Dec 18, 2025 CVE-2025-14178

Heap buffer overflow in array_merge()

Update PHP to

8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30

+ 1 older release
medium Dec 18, 2025 CVE-2025-14177

Information Leak of Memory in getimagesize

Update PHP to

8.5.x 8.5.1 8.4.x 8.4.16 8.3.x 8.3.29 8.2.x 8.2.30

+ 1 older release
medium Jul 3, 2025 CVE-2025-1735

pgsql extension does not check for errors during escaping

Update PHP to

8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29

+ 1 older release
medium Jul 3, 2025 CVE-2025-6491

NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

Update PHP to

8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29

+ 1 older release
low Jul 3, 2025 CVE-2025-1220

Null byte termination in hostnames

Update PHP to

8.4.x 8.4.10 8.3.x 8.3.23 8.2.x 8.2.29

+ 1 older release
medium Mar 13, 2025 CVE-2024-11235

Reference counting in php_request_shutdown causes Use-After-Free

Update PHP to

8.4.x 8.4.5 8.3.x 8.3.19
low Mar 13, 2025

Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used

Update PHP to

8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28

+ 1 older release
medium Mar 13, 2025 CVE-2025-1219

libxml streams use wrong `content-type` header when requesting a redirected resource

Update PHP to

8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28

+ 1 older release
medium Mar 13, 2025 CVE-2025-1736

Stream HTTP wrapper header check might omit basic auth header

Update PHP to

8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28

+ 1 older release
medium Mar 13, 2025 CVE-2025-1861

Stream HTTP wrapper truncate redirect location to 1024 bytes

Update PHP to

8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28

+ 1 older release
medium Mar 13, 2025 CVE-2025-1734

Streams HTTP wrapper does not fail for headers with invalid name and no colon

Update PHP to

8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28

+ 1 older release
medium Mar 13, 2025 CVE-2025-1217

Header parser of `http` stream wrapper does not handle folded headers

Update PHP to

8.4.x 8.4.5 8.3.x 8.3.19 8.2.x 8.2.28

+ 1 older release
high Nov 21, 2024 CVE-2024-8929

[Mysqlnd] Leak partial content of the heap through heap buffer over-read

Update PHP to

8.3.x 8.3.14 8.2.x 8.2.26

+ 1 older release
medium Nov 21, 2024 CVE-2024-8932

OOB access in ldap_escape

Update PHP to

8.3.x 8.3.14 8.2.x 8.2.26

+ 1 older release
medium Nov 21, 2024 CVE-2024-11234

Configuring a proxy in a stream context might allow for CRLF injection in URIs

Update PHP to

8.3.x 8.3.14 8.2.x 8.2.26

+ 1 older release
medium Nov 21, 2024 CVE-2024-11236

Integer overflow in the firebird and dblib quoters causing OOB writes

Update PHP to

8.3.x 8.3.14 8.2.x 8.2.26

+ 1 older release
medium Nov 21, 2024 CVE-2024-11233

Single byte overread with convert.quoted-printable-decode filter

Update PHP to

8.3.x 8.3.14 8.2.x 8.2.26

+ 1 older release
low Nov 21, 2024

Heap-Use-After-Free in sapi_read_post_data Processing in CLI SAPI Interface

Update PHP to

8.3.x 8.3.14 8.2.x 8.2.26

+ 1 older release
high Sep 28, 2024 CVE-2024-4577

PHP RCE: A Bypass of CVE-2012-1823, Argument Injection in PHP-CGI

Update PHP to

8.3.x 8.3.8 8.2.x 8.2.20

+ 1 older release
medium Sep 27, 2024 CVE-2024-8927

cgi.force_redirect configuration is bypassable due to the environment variable collision

Update PHP to

8.3.x 8.3.12 8.2.x 8.2.24

+ 1 older release
medium Sep 27, 2024 CVE-2024-8926

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

Update PHP to

8.3.x 8.3.12 8.2.x 8.2.24

+ 1 older release
low Sep 27, 2024 CVE-2024-8925

Erroneous parsing of multipart form data

Update PHP to

8.3.x 8.3.12 8.2.x 8.2.24

+ 1 older release
low Sep 27, 2024 CVE-2024-9026

[PHP-FPM] Logs from childrens may be altered

Update PHP to

8.3.x 8.3.12 8.2.x 8.2.24

+ 1 older release
high Jun 9, 2024 CVE-2024-5585

bypass CVE-2024-1874

Update PHP to

8.3.x 8.3.8 8.2.x 8.2.20

+ 1 older release
medium Jun 9, 2024 CVE-2024-5458

Filter bypass in filter_var (FILTER_VALIDATE_URL)

Update PHP to

8.3.x 8.3.8 8.2.x 8.2.20

+ 1 older release
high Apr 11, 2024 CVE-2024-2757

mb_encode_mimeheader runs endlessly for some inputs

Update PHP to

8.3.x 8.3.6
low Apr 11, 2024 CVE-2024-3096

password_verify can erroneously return true, opening ATO risk

Update PHP to

8.3.x 8.3.6 8.2.x 8.2.18

+ 1 older release
critical Apr 11, 2024 CVE-2024-1874

Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows

Update PHP to

8.3.x 8.3.6 8.2.x 8.2.18

+ 1 older release
medium Apr 11, 2024 CVE-2024-2756

__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

Update PHP to

8.3.x 8.3.6 8.2.x 8.2.18

+ 1 older release
low Jun 12, 2023 CVE-2023-3247

Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

Update PHP to

8.2.x 8.2.7

+ 1 older release
low Feb 15, 2023 CVE-2023-0567

BCrypt hashes erroneously validate if the salt is cut short by `$`

Update PHP to

8.2.x 8.2.3

+ 1 older release
high Feb 15, 2023 CVE-2023-0662

DoS vulnerability when parsing multipart request body

Update PHP to

8.2.x 8.2.3

+ 1 older release