Fixed (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)

Fixed (Information Leak of Memory in getimagesize). (CVE-2025-14177)

Fixed (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)

Fixed (IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison). (CVE-2026-91768)

Fixed (Heap buffer overflow in phpopensslmatcheswildcardname() on crafted server certificate wildcard CN). (CVE-2026-91767)

Cross-origin credential leak in HTTP stream wrapper redirects

Fixed (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)

Fixed (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)

Fixed (Integer overflow in phartarnumber() allowing TAR archive entry injection). (CVE-2026-6103)

Fixed (Out-of-bounds read in convert. stream filters when line-break-chars contains NUL). (CVE-2026-92842)

The errorlog function in basicfunctions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and openbasedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.

ext/openssl: Memory corruption in opensslencrypt with AES-WRAP-PAD

Fixed bug (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)

Fixed bug (Buffer underflow in bcshiftaddsub). (CVE-2019-11046)

A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference: https://bugs.php.net/bug.php?id=78863

Fixed bug GHSA-h746-cjrr-wfmr (passwordverify can erroneously return true, opening ATO risk). (CVE-2024-3096)

Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.

The parsestr function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.

Fixed (Use-after-free after header parsing failure with SOAPPERSISTENCESESSION). (CVE-2026-7261)

Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)

Fixed (Signed integer overflow of char array offset). (CVE-2026-7568)

Fixed and (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)

Fixed (Out-of-bounds access in mbflname2encodingex()). (CVE-2026-6104)

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wpabspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wpabspath values to simplefields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allowurlinclude is enabled.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, 8.5. before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, when SoapServer is configured with SOAPPERSISTENCESESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mbregexencoding().

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.