https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:05:42.926579+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:40416 ALSA-2026:40416 — Low: php:8.2 security, bug fix, and enhancement update 2026-10-03T09:05:43.728917+00:00

Affected: AlmaLinux:9: apcu-panel, AlmaLinux:9: php, AlmaLinux:9: php-bcmath, AlmaLinux:9: php-cli, AlmaLinux:9: php-common, AlmaLinux:9: php-dba, AlmaLinux:9: php-dbg, AlmaLinux:9: php-devel, AlmaLinux:9: php-embedded, AlmaLinux:9: php-enchant and 21 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.2.32 for CVE-2026-14355 in 9.8.z (JIRA:AlmaLinux-192622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-15257 bdu:2026-15257 2026-10-03T09:05:43.729039+00:00 bdu:2026-15257 https://cve.radiocsirt.org/vuln/bell-cve-2026-14355 BELL-CVE-2026-14355 2026-10-03T09:05:43.729058+00:00

Affected: Alpaquita:23: php81, Alpaquita:25: php83, Alpaquita:stream: php83

 https://cve.radiocsirt.org/vuln/bit-libphp-2026-14355 BIT-libphp-2026-14355 — ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD 2026-10-03T09:05:43.729081+00:00

Affected: Bitnami: libphp

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0843 certfr-2026-avi-0843 — De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer un problème de s… 2026-10-03T09:05:43.729103+00:00 certfr-2026-avi-0843 https://cve.radiocsirt.org/vuln/euvd-2026-333302 EUVD-2026-333302 2026-10-03T09:05:43.729119+00:00 EUVD-2026-333302 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14355 fkie_cve-2026-14355 2026-10-03T09:05:43.729129+00:00

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-14355 msrc_CVE-2026-14355 — ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD 2026-10-03T09:05:43.729152+00:00 msrc_CVE-2026-14355 https://cve.radiocsirt.org/vuln/oesa-2026-3048 OESA-2026-3048 — php security update 2026-10-03T09:05:43.729169+00:00

Affected: openEuler:22.03-LTS-SP4: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es):

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.(CVE-2026-14355)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11269-1 openSUSE-SU-2026:11269-1 — php8-8.5.8-1.1 on GA media 2026-10-03T09:05:43.729193+00:00

php8-8.5.8-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:34164 RHSA-2026:34164 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-03T09:05:43.729209+00:00

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

 https://cve.radiocsirt.org/vuln/rlsa-2026:40416 RLSA-2026:40416 — Low: php:8.2 security, bug fix, and enhancement update 2026-10-03T09:05:43.729225+00:00

Affected: Rocky Linux:9: php, Rocky Linux:9: php-pecl-apcu, Rocky Linux:9: php-pecl-rrd, Rocky Linux:9: php-pecl-xdebug3, Rocky Linux:9: php-pecl-zip

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.2.32 for CVE-2026-14355 in 9.8.z (JIRA:Rocky Linux-192622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:22635-1 SUSE-SU-2026:22635-1 — Security update for php8 2026-10-03T09:05:43.729258+00:00

Security update for php8

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-14355 UBUNTU-CVE-2026-14355 2026-10-03T09:05:43.729274+00:00

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:25.10: php8.4, Ubuntu:26.04:LTS: php8.5

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2186 WID-SEC-W-2026-2186 — PHP: Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-03T09:05:43.729302+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um einen Denial of Service Angriff durchzuführen.