Most recent entries from all

ALSA-2026:40416 — Low: php:8.2 security, bug fix, and enhancement update

Affected: AlmaLinux:9: apcu-panel, AlmaLinux:9: php, AlmaLinux:9: php-bcmath, AlmaLinux:9: php-cli, AlmaLinux:9: php-common, AlmaLinux:9: php-dba, AlmaLinux:9: php-dbg, AlmaLinux:9: php-devel, AlmaLinux:9: php-embedded, AlmaLinux:9: php-enchant and 21 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.2.32 for CVE-2026-14355 in 9.8.z (JIRA:AlmaLinux-192622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-15257

BELL-CVE-2026-14355

Affected: Alpaquita:23: php81, Alpaquita:25: php83, Alpaquita:stream: php83

BIT-libphp-2026-14355 — ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

Affected: Bitnami: libphp

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

certfr-2026-avi-0843 — De multiples vulnérabilités ont été découvertes dans PHP. Elles permettent à un attaquant de provoquer un problème de s…

certfr-2026-avi-0843

EUVD-2026-333302

fkie_cve-2026-14355

msrc_CVE-2026-14355 — ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

msrc_CVE-2026-14355

OESA-2026-3048 — php security update

Affected: openEuler:22.03-LTS-SP4: php

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. Security Fix(es):

openSUSE-SU-2026:11269-1 — php8-8.5.8-1.1 on GA media

php8-8.5.8-1.1 on GA media

RHSA-2026:34164 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD

RLSA-2026:40416 — Low: php:8.2 security, bug fix, and enhancement update

Affected: Rocky Linux:9: php, Rocky Linux:9: php-pecl-apcu, Rocky Linux:9: php-pecl-rrd, Rocky Linux:9: php-pecl-xdebug3, Rocky Linux:9: php-pecl-zip

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD (CVE-2026-14355)

Bug Fix(es) and Enhancement(s):

* Rebase PHP to 8.2.32 for CVE-2026-14355 in 9.8.z (JIRA:Rocky Linux-192622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:22635-1 — Security update for php8

Security update for php8

UBUNTU-CVE-2026-14355

Affected: Ubuntu:Pro:14.04:LTS: php5, Ubuntu:Pro:18.04:LTS: php7.2, Ubuntu:Pro:20.04:LTS: php7.4, Ubuntu:22.04:LTS: php8.1, Ubuntu:24.04:LTS: php8.3, Ubuntu:25.10: php8.4, Ubuntu:26.04:LTS: php8.5

WID-SEC-W-2026-2186 — PHP: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um einen Denial of Service Angriff durchzuführen.