CVE-2026-91766

PHP: information disclosure

Risk score: 56/100
CVSS: 5.9 v3.1
Exploit chance (30 days): 0.3%
Published: 25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials tha…
Affected: PHP before 7.58.0
Fix: Upgrade PHP to 7.58.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

PHP2Shell: Red, act today. PHP uses longjmp() for out-of-memory (OOM) errors, which can lead to remote code execution (RCE). An attacker could exploit this vulnerability to execute arbitrary code on a targeted system.

The flaws

CVE-2026-91766: Information disclosure (CVSS 5.9 · EPSS 0%)
CVE-2026-109618: Use-after-free can lead to remote code execution (CVSS 9.8 · EPSS 12%)
CVE-2026-109619: PHP has various global state that temporarily points into request memory (CVSS 8.1 · EPSS 6%)
CVE-2026-91765: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Upgrade PHP: 7.58.0 or later on your release line

Who is exposed: {'products': ['PHP'], 'packages': [], 'versions': ['all versions']}

Where it stands

Exploitation reported in the press
6 outlets covering it

How it unfolded

24 Sep, PHP releases (official): PHP 8.3.35 Released!
24 Sep, PHP releases (official): PHP 8.5.11 Released!
21 Oct, The Hacker News (press): PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
21 Oct, Infosecurity Magazine (press): Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
21 Oct, CISA advisories (US) (official): Critical Vulnerabilities in PHP Require Immediate Patching
21 Oct, Ubuntu security notices (official): USN-8948-2: PHP vulnerabilities
21 Oct, PHP releases (official): PHP 8.6.0 RC4 available for testing
23 Oct, PHP releases (official): Informational advisory: Session upload progress
23 Oct, SecurityWeek (press): Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
23 Oct, BleepingComputer (press): PHP shares mitigation for new RCE vulnerability with no patch
23 Oct, Dark Reading (press): Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
25 Oct, Help Net Security (press): Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

Connects to

Same weakness: Information disclosure (CWE-200). 197 other warnings in 30 days
Same product: Earlier PHP warnings. 7 in the last 90 days
Reported alongside: PHP: with the next release. CVE-2026-115560 · in 1 of the same article

Why it is Yellow

CVSS 5.9 medium
Public exploit or proof of concept referenced
On your watchlist: php

References

https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92

Original description

When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).

Last activity 25 Sep 2026. Patch Forecast updates every hour.