OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

Affected and fixed versions

In PHP itself. Find the row for the version you run, and update to the release next to it.

Upgrade

Update PHP to the release for the branch you are on, wherever it is installed: your Docker image, server packages or hosting panel. Branches past end of life get no fix, so move to a supported branch.

• PHP 8.5.11
• PHP 8.4.26
• PHP 8.3.35
• PHP 8.2.34

Paste this into a coding agent that can read your project, such as Claude Code, Codex or Amp. It finds the PHP versions your project runs on and checks them against the versions above, without changing anything.

Check whether the PHP project you have access to runs a PHP version affected by this security advisory in PHP itself, and tell me what to update. Do a read-only check: don't edit files, don't change any PHP install, and don't try to reproduce the flaw.

Advisory: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL (CVE-2026-92842, GHSA-88hq-2827-7pg6)
Details: https://phpnews.net/security/php/ghsa-88hq-2827-7pg6

Fixed releases on branches that still get security fixes:
- 8.5.0 – 8.5.10: update to 8.5.11
- 8.4.0 – 8.4.25: update to 8.4.26
- 8.3.0 – 8.3.34: update to 8.3.35
- 8.2.0 – 8.2.33: update to 8.2.34

Branches past end of life get no fix: any version on one of them should be treated as affected.

1. Find every place the project pins or installs PHP: Dockerfiles and compose files, CI workflows, deploy and provisioning scripts, platform config (.php-version, Forge, Vapor, Cloud or Herd settings), and composer.json's config.platform.php and require.php.
2. For each, read the PHP version it runs. Where only a branch is given (php:8.3, PHP 8.3), say the patch version depends on when the image or server was last updated.
3. Compare each version with the fixed releases above.
4. Read the advisory and say whether the project uses what it describes (a function, extension or SAPI). Say which you could check and which you couldn't.
5. Report a table: file | PHP version | affected (yes, no or unknown) | uses the affected feature (yes, no or unknown) | update to | evidence.

Sources

• GitHub advisory GHSA-88hq-2827-7pg6 →
• CVE-2026-92842 on cve.org →