PHP Development Team Releases Security Updates for Multiple Vulnerabilities

The PHP development team has released security updates in response to the discovery of multiple vulnerabilities. The updates were made available on September 24, 2026, for PHP versions 8.5.11, 8.4.26, 8.3.35, and 8.2.34. Each version is categorized as a security release, urging users of each branch to update their software.

While the fixes vary depending on the version, a total of 11 corrections have been implemented for vulnerabilities that have been assigned CVE numbers. Notably, in FPM, a fix was made for "CVE-2026-91768," which allowed access control to be bypassed when processing IPv6 addresses. Additionally, vulnerabilities relating to OpenSSL were addressed, including "CVE-2026-91769" and "CVE-2026-91767."

Other fixes include addressing an issue in the MySQLnd wire protocol packet processing, identified as "CVE-2025-1218," and a vulnerability in Phar that allowed entries to be inserted into tar archives, labeled as "CVE-2026-6103." Vulnerabilities stemming from unbounded recursion and integer overflow in SOAP processing were also corrected.

The HTTP stream wrapper had vulnerabilities identified, such as "CVE-2026-91766," which allowed authentication information to leak to a different origin during redirects, and "CVE-2026-93682," which caused out-of-bounds reading due to an empty Location header. The updates also addressed issues related to stream filters and file handling in Windows.