# Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage (CVE-2026-91765, CVE-2026-91768, CVE-2026-6103 and 8 Others) — GovCERT.HK A26-09-40

> GovCERT.HK Security Alert A26-09-40 (25 Sep 2026) covers 11 CVEs fixed in PHP 8.5.11, 8.4.26, 8.3.35, and 8.2.34, spanning the SOAP, OpenSSL, PHP-FPM, Phar, Standard, and MySQLnd components. Impacts include unauthenticated remote denial of service via unbounded XML recursion in SoapServer, an IPv6 FastCGI ACL bypass, a TLS certificate-verification bypass, and cross-origin credential leakage on HTTP redirects. No CVE is listed in the CISA KEV catalog and no public proof-of-concept exploit has been confirmed for any of them as of disclosure.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2658
- **ID:** TL-2026-2658
- **Severity:** MEDIUM (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-17545, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682

## Description

On 22-24 September 2026 the PHP Foundation shipped four coordinated security releases — PHP 8.2.34 and 8.3.35 (security-only) and PHP 8.4.26 and 8.5.11 (bug-fix + security) — closing out a set of 11 CVEs across six components. GovCERT.HK published Security Alert A26-09-40 on 25 September 2026 summarizing the bundle at its own 'Security Alert' (not 'High Threat Security Alert') tier, i.e. medium severity by their classification convention, with the stated cross-cutting impact framed as denial of service. NVD's per-CVE records, however, show the bundle also carries information-disclosure and authentication-bypass consequences beyond DoS.

The highest-severity issue, CVE-2026-91765 (CVSS 7.5), is an unbounded-recursion flaw in the SOAP extension: cleanup_xml_node() in the XML parser recurses once per nesting level with no depth limit, so an unauthenticated attacker can POST a SOAP request with tens of thousands of nested elements to any SoapServer endpoint, exhaust the call stack, and crash the worker process; the same unbounded-recursion pattern also exists in the SOAP value decoder and the WSDL node-search helper per the GHSA-rgrp-mwpx-f6rm write-up.

A second cluster affects OpenSSL/TLS client verification. CVE-2026-91767 is a heap buffer over-read in php_openssl_matches_wildcard_name() (ext/openssl/xp_ssl.c): a length argument passed to memchr() underflows when a malicious server presents a wildcard certificate name longer than the hostname being verified, letting the server force the client to read past a heap allocation. CVE-2026-91769 is a logic flaw where PHP's peer-verification code checks a certificate's subjectAltName entries and, when none match, incorrectly falls back to the Common Name — violating RFC 6125, which requires the CN to be ignored once any subjectAltName is present — so a certificate with a non-matching SAN but a matching CN is still accepted. Both are reachable by default because PHP enables peer-name verification automatically on outbound TLS client streams.

A third issue, CVE-2026-91768, is an access-control bypass in PHP-FPM: the IPv6 branch of the FastCGI client-address check compares only the first 12 of 16 address bytes, so listen.allowed_clients effectively matches on a /96 prefix rather than the full address, letting any attacker who can source a request from a matching /96 network reach an endpoint that was meant to be restricted.

A fourth cluster covers the Standard extension's HTTP stream wrapper: CVE-2026-91766 forwards Authorization, Cookie, and Proxy-Authorization headers unchanged when the wrapper follows a redirect, even across a different host, port, or an HTTPS-to-HTTP downgrade, allowing a malicious or compromised redirect target to capture credentials meant for the original origin; CVE-2026-93682 is a one-byte heap over-read when a redirect response carries an empty Location header, letting a malicious server influence where the read runs off into and where the client's dereferenced redirect target ends up; and CVE-2026-92842 is a heap-memory disclosure in the convert.base64-encode / convert.quoted-printable-encode / convert.quoted-printable-decode stream filters, where the constructor's line-break-chars option tracks length separately from the string and mishandles embedded NUL bytes, disclosing adjacent heap memory in filtered output.

Rounding out the set: CVE-2026-6103 is an integer overflow in Phar's phar_tar_number(), which parses an 11-digit octal TAR size field into an unchecked uint32_t so a size above 0xFFFFFFFF silently wraps, letting a crafted TAR archive smuggle entries that PharData extracts as if legitimate; CVE-2026-17545 is PHP's failure on Windows to reject reserved device names (CON, PRN, AUX, NUL, COM1-COM9, LPT1-LPT9, CONIN$, CONOUT$) as path components in filesystem/stream functions, so an attacker-supplied filename can open a character device and hang a worker thread; CVE-2025-14181 is a SOAP HTTP client integer-overflow-to-buffer-overflow, where a buffer-growth check relies on undefined-behavior signed-integer overflow that a compiler may optimize away, letting a malicious SOAP server make the client allocate an undersized buffer it then overflows; and CVE-2025-1218 is a set of packet over-reads in the mysqlnd wire-protocol parser, which reads fixed-width fields out of server packets before confirming enough bytes remain, so a malicious or compromised MySQL server can send a truncated packet and crash the client.

None of the 11 CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of 25 September 2026, and third-party exploit trackers (TheHackerWire) report no confirmed public proof-of-concept for the two highest-severity issues (CVE-2026-91765, CVE-2026-91768) at disclosure. All 11 require either an attacker-controlled/compromised counterparty server (MySQL, SOAP, HTTP/TLS) or direct network reachability to a PHP-FPM/SOAP endpoint — none is exploitable purely client-side without such a position.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1590.005 IP Addresses
- T1588.006 Vulnerabilities
- T1583.004 Server
- T1190 Exploit Public-Facing Application
- T1557 Adversary-in-the-Middle
- T1212 Exploitation for Credential Access
- T1539 Steal Web Session Cookie
- T1499.004 Application or System Exploitation

## Sources

- [Security Alert (A26-09-40): Multiple Vulnerabilities in PHP](https://www.govcert.gov.hk/en/alerts_detail.php?id=2082)
- [PHP 8 ChangeLog (8.5.11 / 8.4.26 / 8.3.35 / 8.2.34)](https://www.php.net/ChangeLog-8.php)
- [PHP 8.4.26: Release Information, Changelog, and Download links](https://php.watch/versions/8.4/releases/8.4.26)
- [PHP 8.2.34 Release Information](https://php.watch/versions/8.2/releases/8.2.34)
- [NVD - CVE-2026-91765 (SOAP unbounded recursion, CVSS 7.5)](https://nvd.nist.gov/vuln/detail/CVE-2026-91765)
- [NVD - CVE-2026-91768 (FPM IPv6 ACL bypass, CVSS 6.5)](https://nvd.nist.gov/vuln/detail/CVE-2026-91768)
- [NVD - CVE-2026-91766 (Cross-origin credential leak on redirect, CVSS 5.9)](https://nvd.nist.gov/vuln/detail/CVE-2026-91766)
- [GitHub Security Advisory GHSA-rgrp-mwpx-f6rm (CVE-2026-91765)](https://github.com/advisories/GHSA-rgrp-mwpx-f6rm)
- [GitHub Security Advisory GHSA-62xp-839h-2637 (CVE-2026-91768)](https://github.com/advisories/GHSA-62xp-839h-2637)
- [GitHub Security Advisory GHSA-xr7j-rvgx-xq5p (CVE-2026-91767)](https://github.com/advisories/GHSA-xr7j-rvgx-xq5p)
- [Critical PHP Vulnerabilities Patched in New Releases](https://securityonline.info/php-vulnerabilities-patch/)
- [PHP 8.2, 8.3, 8.4 and 8.5 updated to their latest security patch releases](https://docs.pantheon.io/release-notes/2026/09/php-82-83-84-85-security-updates)
- [CVE-2026-91765 PoC, Exploit Status & Vulnerability Details](https://www.thehackerwire.com/vulnerability/CVE-2026-91765/)
- [CVE-2026-91768 PoC, Exploit Status & Vulnerability Details](https://www.thehackerwire.com/vulnerability/CVE-2026-91768/)
- [CVE-2026-91767: PHP Vulnerability (CVSS 6.5) — Fix & Details](https://www.strix.ai/cve/CVE-2026-91767)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2658