DE EN IT

~/security / php

PHP: latest vulnerabilities

The newest CVEs for PHP, daily from the NVD. Descriptions come from the database.

CVEPublishedSeverityDescription
CVE-2026-1754430 July 2026high 8.1Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
CVE-2026-143553 July 2026medium 5.6In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation i…

Data: NVD (nvd.nist.gov), as of 23 October 2026. No warranty — always check the vendor's advisory.

daniele@mikweb: ~/blog — ls

Context and patch guides

PHP emergency patch (PHP2Shell): how to check and patch your serversMitigating PHP2Shell when no update exists yet: php.ini settings for NAS, Plesk and your own servers

Supported PHP versions → · Weekly patch radar →

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).

← Vulnerabilities