PHP 8.5.11 and the 24 September 2026 security releases
PHP's official release JSON reports PHP 8.5.11, 8.4.26, 8.3.35 and 8.2.34, all
dated 24 September 2026 and tagged security, when checked on 2 October. The endpoint
changes as new releases arrive. The normalized 8.x observation is kept in
data/sources/php-release.json.
Security advisories
The php-src repository published these GitHub security advisories on 24 September 2026. Severity is the advisory's own rating. In each advisory, affected versions are those below the listed fixed version on each branch.
| Advisory | CVE | Severity | Component | Summary |
|---|---|---|---|---|
| GHSA-rgrp-mwpx-f6rm | CVE-2026-91765 | high | ext/soap | Unbounded recursion in server-side cleanup_xml_node |
| GHSA-cj93-vc83-wgqv | CVE-2025-14181 | medium | ext/soap | Integer overflow to buffer overflow in SOAP HTTP parsing |
| GHSA-7875-c8px-7q5f | CVE-2026-93682 | medium | ext/standard | Out-of-bounds read in the HTTP stream wrapper on a redirect with an empty Location header |
| GHSA-fpwc-w8rq-cr92 | CVE-2026-91766 | medium | ext/standard | Cross-origin credential leak in HTTP stream wrapper redirects |
| GHSA-88hq-2827-7pg6 | CVE-2026-92842 | medium | ext/standard | Out-of-bounds read / information leak in convert.* stream filters when line-break characters contain NUL |
| GHSA-vvx9-73fr-5jjx | CVE-2026-91769 | medium | ext/openssl | TLS hostname verification falls back to CN after a SAN mismatch |
| GHSA-xr7j-rvgx-xq5p | CVE-2026-91767 | medium | ext/openssl | Heap buffer overflow in php_openssl_matches_wildcard_name with a crafted wildcard CN |
| GHSA-62xp-839h-2637 | CVE-2026-91768 | medium | PHP-FPM | IPv6 ACL bypass in listen.allowed_clients through a partial address comparison |
| GHSA-j3wh-g957-2m85 | CVE-2026-6103 | medium | ext/phar | Integer overflow in TAR phar_tar_number() allowing archive entry injection |
| GHSA-9f67-6fw4-hpfp | CVE-2026-17545 | medium | Windows file/stream I/O | Reserved device names are not rejected, which can cause denial of service |
| GHSA-r6x9-5r99-36j7 | CVE-2025-1218 | low | ext/mysqlnd | Packet overreads in mysqlnd protocol handling |
| GHSA-ch8v-r6jh-4vvr | none listed | low | ext/filter | FILTER_SANITIZE_ENCODED did not encode byte 0xFF |
For the first eleven advisories, the fixed versions are 8.2.34, 8.3.35, 8.4.26 and 8.5.11. The official ChangeLog lists all eleven under each of those four releases.
GHSA-ch8v-r6jh-4vvr differs. Its advisory gives the fixed versions as 8.2.34, 8.3.35, 8.4.25 and 8.5.10, so the 8.4 and 8.5 branches had already received the fix in an earlier release. The ChangeLog names it under 8.2.34 and 8.3.35 only. The earlier 8.4/8.5 fix versions come from the advisory alone and were not traced to a ChangeLog entry.
Limitations
The table summarizes advisory titles and does not assess exploitability for any deployment. Whether an installation is exposed depends on which extensions and SAPIs it uses, for example SOAP, Phar, PHP-FPM or Windows builds. Distribution packages may backport fixes without changing the upstream version number. The advisory list is from the php-src GitHub advisories API on 2 October 2026 and can be revised later.
Related: support lifecycle, version statistics.