PHP: fix CVE-2026-91767 and CVE-2026-91769 (OpenSSL)

What these two advisories fix

The essentials in seven points

• CVE-2026-91769 — moderate severity, CVSS 3.1 score of 4.3. Peer name verification looks at the subjectAltName entries first, then falls back to the Common Name even when the certificate presents a DNS SAN that does not match.
• CVE-2026-91767 — moderate severity, CVSS 3.1 score of 6.5 (CWE-122). In php_openssl_matches_wildcard_name(), a length underflow passed to memchr() causes an out-of-bounds read when the certificate's wildcard name has more literal characters than the host being verified.
• Fixed versions — PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11, for both flaws. Versions 8.4.26 and 8.5.11 appear in the PHP changelog dated 24 September 2026.
• Who is affected — clients that rely on the default value of verify_peer_name, through file_get_contents(), fopen() and stream_socket_client() on https:// and tls://.
• Workaround — the advisory gives none. Disabling verification is not one, it is one more flaw.
• Branches 8.1 and earlier — end of life, no upstream fix. Distribution fixes or third-party backports may exist: check package by package.
• Exploitation — in the sources we consulted, we found no observed exploitation of these two flaws.

What these flaws allow, and what they do not

Rated moderate: is it urgent?

Measure your exposure in four steps

1. 01

   Read the PHP version actually served

   On the server, run php -r 'echo PHP_VERSION, PHP_EOL;'. Do not rely on OPENSSL_VERSION_TEXT: it is not the system OpenSSL library that is fixed, it is the extension code, so the PHP version is what counts. Beware, the CLI may differ from what your sites serve: on a server that hosts several branches, also read the version of each PHP-FPM pool (see the verification step below). On cPanel, the version is read per domain, see our guide to the PHP selector.

2. 02

   Look for calls that go through PHP streams

   List the outgoing calls that carry a literal URL in the code: grep -rnE "(file_get_contents|fopen)\(\s*['\"]https?://|stream_socket_client\(\s*['\"]tls://" /var/www --include='*.php'. On a cPanel hosting account, replace /var/www with /home. Complete with calls whose URL comes from a variable: grep -rnE "(file_get_contents|fopen|stream_socket_client)\(\s*\$" /var/www --include='*.php'. Think about WordPress plugins and the vendor folder: outgoing calls often hide there.

3. 03

   Spot verifications that are already disabled

   Run grep -rn "verify_peer_name" /var/www --include='*.php'. A value of false means no host name is verified at all: that code is exposed to far more than these two advisories, whatever the PHP version. Fix it before anything else.

4. 04

   Rank your sites

   A site is a priority if it combines a branch below the floor in the table that follows and outgoing calls through streams. Calls made through the cURL extension are not cited by the advisory, which lists PHP streams. WordPress and most HTTP libraries generally use cURL when it is available, but fall back to streams otherwise: do not rule them out without checking.

Which version to install for your branch

Scroll the table

Apply the fix for your environment

1. 05

   Debian and Ubuntu

   Refresh the index with sudo apt update, then upgrade the packages of your branch with sudo apt install --only-upgrade 'php8.3*' (replace 8.3 with your branch). To see what is pending: apt list --upgradable 2>/dev/null | grep -i php. Distributions often fix through a backport without changing the upstream number: read the package log with apt changelog php8.3-cli | grep -i CVE-2026-91769. With a third-party repository such as Sury, the same commands apply.

2. 06

   RHEL, AlmaLinux and Rocky Linux

   Run sudo dnf update 'php*'. If you use a module stream, the branch follows the enabled module: dnf module list --enabled php shows it. Then check the log with rpm -q --changelog php-cli | grep -i CVE-2026-91769. With a third-party repository, package names change: adapt the pattern to what rpm -qa 'php*' returns.

3. 07

   cPanel: EasyApache 4 and the PHP selector

   EasyApache 4 branches are packages named ea-php83, ea-php84, and so on. If you have root, list them with rpm -qa 'ea-php*' | sort then update them with sudo dnf update 'ea-php*'. Read the log with rpm -qa --changelog 'ea-php83*' | grep -i CVE-2026-91769 and the real version with /opt/cpanel/ea-php83/root/usr/bin/php -v. On shared hosting, the host does the update: your part is to check, in the cPanel PHP selector (MultiPHP Manager, or Select PHP Version on CloudLinux), that each domain runs on a fixed branch.

4. 08

   Docker

   An image is not fixed in place: rebuild it, pulling the updated base, with docker build --pull --no-cache -t your-image ., or docker compose build --pull --no-cache with Compose, then restart with docker compose up -d. Check the result inside the container with docker run --rm your-image php -v. A floating tag such as php:8.4-fpm only moves if the upstream image was rebuilt: the printed number is what counts, not the tag name.

5. 09

   Restart the PHP services

   PHP-FPM and Apache keep the old code in memory until they are reloaded. On Debian or Ubuntu: sudo systemctl restart php8.3-fpm (adapt the branch), and sudo systemctl restart apache2 if you use mod_php. On RHEL or AlmaLinux: sudo systemctl restart httpd. On cPanel with PHP-FPM, systemctl list-units 'ea-php*' gives the exact name of the service to restart.

6. 10

   Check the version actually served

   The CLI is not the web service. Query the FPM binary: php-fpm8.3 -v on Debian and Ubuntu, php-fpm -v on RHEL and derivatives, or the domain's version in cPanel. The number must reach the floor of your branch, or its log must cite CVE-2026-91769. Finish with a test outgoing call: php -r 'echo strlen(file_get_contents("https://your-domain.com/")), PHP_EOL;'.

If your branch is end of life (8.1 and earlier)

A third OpenSSL fix in the same quarter

Troubleshooting after the update

Errors you may meet and their remedies

• SSL operation failed with code 1 then certificate verify failed — typical full message: stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages: error:0A000086:SSL routines::certificate verify failed. Probable cause: the certificate presents a DNS SAN that does not contain the host being called, but its CN does. The old check accepted it by falling back to the CN, the new one rejects it. Read the certificate with openssl s_client -connect interne.your-domain.com:443 -servername interne.your-domain.com </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName. Remedy: reissue the certificate with a correct DNS SAN for every name used, never disable verification.
• file_get_contents(): Failed to enable crypto — warning that accompanies the previous one. Read the full message that follows: depending on the version, you may also find Peer certificate CN=… did not match expected CN=…. Same cause, same remedy.
• A certificate with no SAN at all, only a CN, still fails — the fix keeps the CN fallback for certificates without a service identifier. The cause is therefore elsewhere: authority not trusted by the client, host called by an alias or an IP address missing from the certificate, expired certificate. Remedy: add the internal authority to cafile in the stream context, and reissue the certificate with a SAN.
• child exited on signal 11 (SIGSEGV) in the PHP-FPM log — a worker crashing during an outgoing TLS call is compatible with CVE-2026-91767. Do not conclude from that sign alone: check the version, update and see whether the pattern disappears.
• php -v still shows the old version — service not restarted, CLI and FPM on different branches, Docker image rebuilt without --pull, or the domain's version unchanged in cPanel. Go back to the verification step.
• The distribution log does not cite the CVE — its absence proves neither that the fix is there nor that it is missing. Consult the distribution's security tracker, and failing that compare the upstream number with the floor in the table.

Build the update into your routine

1. 11

   Record the floor in your inventory

   Add a "minimum version" column per branch to your fleet inventory, with the values from the table. A version below the floor then becomes visible without any research.

2. 12

   Schedule PHP updates

   A PHP security fix is a minor update within the same branch: plan a regular slot rather than a project for each advisory, with a service restart and a check of the version served.

3. 13

   Test an outgoing call after each update

   Replay php -r 'echo strlen(file_get_contents("https://your-domain.com/")), PHP_EOL;' from each server, and a call to your internal services. A certificate error then shows up immediately, not at a customer's.

4. 14

   Connect this fix to the rest of your monitoring

   For the method of surveying a fleet, read the PHP version inventory for a client fleet. For the most critical flaw of the moment, see PHP2Shell. To change a site's version, follow the cPanel PHP selector guide. For a branch that is ending, go back to the PHP 8.2 migration checklist.