Vulnerability in PHP Group PHP

[ Description ]Official description

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3585

  PHP: Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-92842CVE-2026-91765CVE-2026-93682+7 more CVEs
• CERT-FR24 Sep 2026CERTFR-2026-AVI-1227

  Multiple vulnerabilities in PHP Translated from French

  Multiple vulnerabilities have been discovered in PHP. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a breach of data integrity.

  CVE-2025-14181CVE-2026-91765CVE-2026-92842+8 more CVEs

[ References ]References

• github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx