Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-91769

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and…

Risk score
41/100
CVSS
4.3 v3.1
Exploit chance (30 days)
0.1%
Published
25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when…
Affected
PHP
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Public proof of concept

Story map

Story map: PHP2ShellTHE FLAWSTHE FIXCVE-2026-91769PHP's OpenSSL stream peerverification checks thecertificate's subjectAltName…CVSS 4.3 · EPSS 0%CVE-2026-109618Use-after-free can lead toremote code executionCVSS 9.8 · EPSS 12%CVE-2026-109619PHP has various global statethat temporarily points intorequest memoryCVSS 8.1 · EPSS 6%CVE-2026-91765Denial of serviceCVSS 7.5 · EPSS 1%FixCheck the linked advisory for afix, as none is provided in therecord.Who is exposed{'products': ['PHP'], 'packages':[], 'versions': ['all versions']}RED · ACT TODAYPHP2ShellPHP uses longjmp() forout-of-memory (OOM) errors,which can lead to remote codeexecution (RCE). An attackercould exploit this vulnerability toexecute arbitrary code on atargeted system.Where it standsExploitation reported in the press6 outlets covering itHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.24 Sep · PHP releasesPHP 8.3.35 Released!24 Sep · PHP releasesPHP 8.5.11 Released!21 Oct · The Hacker NewsPHP2Shell: Two Unpatched Critical PHP RCE Flaws(CVSS 9.2) Trigger Emergency Security Alert21 Oct · Infosecurity MagazineCritical PHP Vulnerabilities Leaked Ahead ofScheduled Security Patches21 Oct · CISA advisories (US)Critical Vulnerabilities in PHP Require ImmediatePatching21 Oct · Ubuntu security noticesUSN-8948-2: PHP vulnerabilities21 Oct · PHP releasesPHP 8.6.0 RC4 available for testing23 Oct · PHP releasesInformational advisory: Session upload progress23 Oct · SecurityWeekMirai Botnet Operators Join PHP2Shell Attacks asASLR Bypass Exploits Emerge23 Oct · BleepingComputerPHP shares mitigation for new RCE vulnerabilitywith no patch23 Oct · Dark ReadingExposed to PHP2Shell? Cyber Experts Weigh in WithAdvice25 Oct · Help Net SecurityWeek in review: PHP vulnerabilities patched,exploited Palo Alto GlobalProtect VPN flawCONNECTS TOSame weaknessCWE-297 (CWE-297)6 other warnings in 30 days →Same productEarlier PHP warnings7 in the last 90 days →Reported alongsidePHP: with the next releaseCVE-2026-115560 · in 1 of the samearticle →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

PHP2Shell: Red, act today. PHP uses longjmp() for out-of-memory (OOM) errors, which can lead to remote code execution (RCE). An attacker could exploit this vulnerability to execute arbitrary code on a targeted system.

The flaws

  • CVE-2026-91769: PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and… (CVSS 4.3 · EPSS 0%)
  • CVE-2026-109618: Use-after-free can lead to remote code execution (CVSS 9.8 · EPSS 12%)
  • CVE-2026-109619: PHP has various global state that temporarily points into request memory (CVSS 8.1 · EPSS 6%)
  • CVE-2026-91765: Denial of service (CVSS 7.5 · EPSS 1%)

The fix

Fix: Check the linked advisory for a fix, as none is provided in the record.

Who is exposed: {'products': ['PHP'], 'packages': [], 'versions': ['all versions']}

Where it stands

  • Exploitation reported in the press
  • 6 outlets covering it

How it unfolded

  1. 24 Sep, PHP releases (official): PHP 8.3.35 Released!
  2. 24 Sep, PHP releases (official): PHP 8.5.11 Released!
  3. 21 Oct, The Hacker News (press): PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
  4. 21 Oct, Infosecurity Magazine (press): Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
  5. 21 Oct, CISA advisories (US) (official): Critical Vulnerabilities in PHP Require Immediate Patching
  6. 21 Oct, Ubuntu security notices (official): USN-8948-2: PHP vulnerabilities
  7. 21 Oct, PHP releases (official): PHP 8.6.0 RC4 available for testing
  8. 23 Oct, PHP releases (official): Informational advisory: Session upload progress
  9. 23 Oct, SecurityWeek (press): Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
  10. 23 Oct, BleepingComputer (press): PHP shares mitigation for new RCE vulnerability with no patch
  11. 23 Oct, Dark Reading (press): Exposed to PHP2Shell? Cyber Experts Weigh in With Advice
  12. 25 Oct, Help Net Security (press): Week in review: PHP vulnerabilities patched, exploited Palo Alto GlobalProtect VPN flaw

Connects to

Why it is Yellow

  • CVSS 4.3 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: php, openssl

References

Original description

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

Last activity 25 Sep 2026. Patch Forecast updates every hour.