PHP 2026-09-24 security releases — 11 CVEs across 8.2–8.5

This tracker is no longer updated. Every tracked Debian suite, NixOS channel, nixpkgs branch, and pkgsrc branch ships the fixes.

Summary

The releases close a dozen unrelated bugs across the interpreter’s extensions rather than one headline flaw, and which of them matter depends on what a host’s PHP is used for:

• Servers accepting requests. A SoapServer endpoint can be crashed by one deeply nested request (CVE-2026-91765), and PHP-FPM’s listen.allowed_clients lets in any IPv6 address that shares the first 96 bits with an allowed one (CVE-2026-91768).
• PHP as a client. Code that fetches URLs, talks TLS, or connects to SOAP or MySQL servers trusts what those servers send back. A malicious server can overflow or over-read heap buffers (CVE-2026-91767, CVE-2025-14181, CVE-2026-93682, CVE-2025-1218), pass hostname verification with a certificate that names a different host (CVE-2026-91769), or collect the Authorization, Cookie, and Proxy-Authorization headers the http:// wrapper forwards across a redirect to another origin or from HTTPS to HTTP (CVE-2026-91766).
• Untrusted input to library code. A crafted TAR archive opened through Phar injects entries of the attacker’s choosing (CVE-2026-6103); an attacker-influenced line-break-chars option on a convert.* stream filter reads past a heap buffer (CVE-2026-92842); and FILTER_SANITIZE_ENCODED may pass the byte 0xFF through unencoded (GHSA-ch8v-r6jh-4vvr).

ℹ️ Each branch has its own fixed release: a host on PHP 8.4 needs 8.4.26, not 8.5.11. Which branch a system runs depends on its distribution — Debian 12 ships PHP 8.2, Debian 13 ships 8.4, while NixOS and pkgsrc offer all four side by side — so the table below gives each row’s PHP branch and the release it needs. A distribution may also backport the fixes onto an older release of the same branch, so the PHP version alone does not settle every row.

Advisories

The PHP 8 changelog lists what each release fixed. Every advisory below is fixed in all four 2026-09-24 releases, with one exception, GHSA-ch8v-r6jh-4vvr; CVE-2026-17545 matters only on Windows.

Severities are the scores in PHP’s advisories, CVSS 3.1 unless marked.

ℹ️ Where the branches differ. 8.2 and 8.3 receive security fixes only, so their releases carry exactly the twelve advisories above. 8.4 and 8.5 are still in active support, so their security releases also carry regular bug fixes, among them memory-safety bugs that got no advisory — use-after-frees in DOM, Intl, and Phar, out-of-bounds reads in BCMath and mb_ereg_replace(), and, in 8.4 only, a buffer overflow in hash_pbkdf2() with a large output length. And GHSA-ch8v-r6jh-4vvr is new in 8.2.34 and 8.3.35 only: the 8.4 and 8.5 fix shipped a month earlier, so an 8.4 or 8.5 host still older than 8.4.25 or 8.5.10 lacks that fix as well.

CVE-2026-17545 applies only to PHP running on Windows: the device-name check it adds is Windows code. None of the distributions tracked here build PHP for Windows, so their rows need only the other advisories of their branch.

Distribution status

A row is Fixed once its package closes every advisory its PHP branch’s 2026-09-24 release fixes (CVE-2026-17545 aside): by carrying that release or a later one, or by backporting all of the fixes onto an older release of the branch. A package that closes some but not all is Partial, with the advisories still open named.

PHP is the upstream PHP release the package builds; Package is what the distribution calls it. Where a release offers several PHP branches, the one its unversioned php package or attribute selects is marked default. Debian versions are the apt-installable value: the <suite>-security archive where it carries the package, since that is what hosts run and where a DSA or DLA fix lands first.

Debian

Debian ships one PHP branch per release, as a versioned source package: php8.2 in bookworm, php8.4 in trixie, forky, and sid. The unversioned php, php-cli, php-fpm packages come from php-defaults and only depend on the branch’s packages, so their version (2:8.4+96 on trixie) says nothing about which PHP release is installed — look at the php8.X-* packages instead. php8.5 is in experimental only, and PHP 8.3 never reached a Debian release — it was only ever in experimental.

Debian’s PHP maintainer normally imports each upstream point release, security uploads to the stable suites included, so the upstream part of the version (everything before the last -) is the PHP release it builds.

The Debian security tracker has a page per CVE; sid, forky, and trixie closed all ten applicable CVEs via a direct 8.4.26 upload (trixie’s via DSA-6514-1), and bookworm closed them via DLA-4819-1 (8.2.34). The tracker marks CVE-2026-17545 not affected (“Only affects PHP on Windows”). GHSA-ch8v-r6jh-4vvr has no CVE and so no tracker page; it reaches a suite with the upstream release or a changelog entry naming it.

forky took the fix once sid’s upload migrated to testing; that migration had initially been blocked by a riscv64 autopkgtest regression in another package, php-arthurhoaro-web-thumbnailer, but went through once that cleared.

Bookworm is in its LTS period, so its PHP updates come as DLAs from the LTS team, into bookworm-security; that archive can run ahead of the main archive, which only catches up at a point release.

pkgsrc

pkgsrc (NetBSD’s package collection, also used on SmartOS, macOS via pkgin, and elsewhere) packages every PHP branch side by side as lang/php82 through lang/php85; the installed package is named after the branch (php84-8.4.26). PHP_VERSION_DEFAULT selects the branch a PHP-dependent package builds against unless the host overrides it — 8.4 on both tracked branches.

pkgsrc-2026Q3, the quarterly branch most pkgsrc hosts run, was cut on 2026-09-21 — before the releases — and received them by pullup from pkgsrc-current almost four weeks later.

The identifier carries an nbN suffix when the package’s PKGREVISION is set. That revision bumps for many reasons besides security patches, so an nbN suffix on its own says nothing about these fixes.

NixOS

nixpkgs builds all four branches from one expression, pkgs/development/interpreters/php/default.nix, as the attributes php82 through php85; the unversioned php (and phpPackages, phpExtensions) is php84. The NixOS services.phpfpm module uses pkgs.php unless a pool sets its own phpPackage. A channel row is fixed once its pinned version reaches the branch’s fixed release, or the expression carries the fixes as patches.

Flake users

A flake input like github:NixOS/nixpkgs/nixos-unstable resolves to the git branch of that name, not to the channel — but the channel bot advances the branch to exactly the revision the channel publishes, so an input following a channel name is answered by that channel’s rows.

Two branches have no channel gating them and will carry the fix earlier — they are listed above as master and release-26.05:

• github:NixOS/nixpkgs/master — the fix’s first appearance anywhere in nixpkgs, the moment it is merged.
• github:NixOS/nixpkgs/release-26.05 — the ungated 26.05 branch, ahead of the nixos-26.05 channel by however long Hydra takes.

No channel can be fixed before the branch it is cut from.

Detection

Check the installed package rather than the running interpreter: a host can carry several PHP branches, and the web server’s may not be the one on PATH.

Debian

List the PHP packages dpkg knows about, with their state and version:

dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\n' 'php8*'

Lines starting ii are installed. The branch is in the package name (php8.4-fpm) and the upstream PHP release is the version up to the last -. Compare it with the row for your suite above; if a later Debian revision of the same release appears (8.4.24-1~deb13u2), check its changelog for backported fixes:

apt changelog php8.4-common

pkgsrc

pkg_info -e 'php8[0-9]-[0-9]*'

The output is php<branch>-<version> plus any nb<PKGREVISION> suffix — for example php84-8.4.25nb1. Cross-reference it against the pkgsrc rows above.

NixOS

Query the PHP versions in the current system closure:

nix-store -q --requisites /run/current-system | grep -- '-php-[0-9]'

Each store path ends in the PHP version it builds (php-8.4.25, or php-8.4.25-dev for the development output). Cross-reference against your channel’s rows above; a project built from a flake or a nix-shell carries its own PHP, pinned by its own nixpkgs input.

Mitigation

Upgrade to your branch’s fixed release — or to a distribution package that carries it — as soon as one is available. Until then, what helps depends on the advisory:

• SOAP servers (CVE-2026-91765). An unauthenticated request to any SoapServer endpoint crashes the worker. If SOAP is not used, disable the extension (phpdismod soap on Debian, then restart PHP-FPM or Apache); otherwise limit who can reach the endpoint.
• PHP-FPM over IPv6 (CVE-2026-91768). Only pools listening on an IPv6 TCP socket with listen.allowed_clients set are affected. A Unix socket, or a firewall rule admitting only the web server’s exact address, closes it.
• Outbound HTTP (CVE-2026-91766, CVE-2026-93682). Code passing Authorization, Cookie, or Proxy-Authorization headers to file_get_contents() or fopen() on http:// and https:// URLs can set the stream context option follow_location to 0 and handle redirects itself.
• Outbound TLS (CVE-2026-91767, CVE-2026-91769). Both are triggered by the certificate a server presents to PHP as a client; there is no configuration workaround beyond not connecting to untrusted hosts.
• Untrusted archives (CVE-2026-6103). Don’t open user-supplied TAR files through Phar or PharData until patched.

No exploit has been published for any of these. The advisories describe proof-of-concept inputs, so crashing a SoapServer or reading past a buffer takes little effort once the fix is public.

Verification log

Every verdict in the table above is backed by a checkable source. This log records the provenance — the advisory, repository index, or git reference that established each fact — so any row can be audited or reproduced. Most readers never need it.

References