Fixed (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)

Fixed (Unbounded recursion in server-side cleanupxmlnode()). (CVE-2026-91765)

Fixed (Heap buffer overflow in phpopensslmatcheswildcardname() on crafted server certificate wildcard CN). (CVE-2026-91767)

Fixed (IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison). (CVE-2026-91768)

Fixed (Out-of-bounds read in convert. stream filters when line-break-chars contains NUL). (CVE-2026-92842)

Fixed (Integer overflow in phartarnumber() allowing TAR archive entry injection). (CVE-2026-6103)

Fixed (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)

Fixed (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)

Fixed (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)

Fixed (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)

Fixed (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)

The errorlog function in basicfunctions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and openbasedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.

PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.

Fixed (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.

ext/openssl: Memory corruption in opensslencrypt with AES-WRAP-PAD

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9.

Fixed bug (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)

Fixed bug (Buffer underflow in bcshiftaddsub). (CVE-2019-11046)

A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference: https://bugs.php.net/bug.php?id=78863

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Fixed bug (mail() may release string with refcount==1 twice). (CVE-2019-11049)

Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)

Buffer overflow and overread in phardirread()

Configuring a proxy in a stream context might allow for CRLF injection in URIs

Fixed bug (OOB access in ldapescape). (CVE-2024-8932)

Fixed bug (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)

Fixed bug (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)

Fixed bug GHSA-h746-cjrr-wfmr (passwordverify can erroneously return true, opening ATO risk). (CVE-2024-3096)