[{"data":1,"prerenderedAt":237},["ShallowReactive",2],{"seo-verification":3,"blog-php-openssl-cve-2026-91767-91769-tls-hostname-verification-update-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-php-openssl-cve-2026-91767-91769-tls-hostname-verification-update-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":158,"ctaBody":159,"ctaButton":160,"ctaUrl":161,"relatedPosts":162},562,"php-openssl-cve-2026-91767-91769-tls-hostname-verification-update",{"fr":12,"en":10,"ar":13,"es":14},"php-openssl-cve-2026-91767-91769-verification-hote-tls-mettre-a-jour","php-openssl-cve-2026-91767-91769-تحديث-php-openssl","php-openssl-cve-2026-91767-91769-verificacion-host-tls-actualizar","PHP: fix CVE-2026-91767 and CVE-2026-91769 (OpenSSL)","Two moderate PHP flaws affect TLS host name verification. Fixed versions per branch, commands for Debian, RHEL, cPanel and Docker, and what to do on end-of-life branches.",13,0,false,"2026-11-02T00:00:00+00:00","2026-11-03T01:01:41+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fphp-openssl-cve-2026-91767-91769-verification-hote-tls-mettre-a-jour-poster.svg","On 24 September 2026, the PHP project published two security advisories on the OpenSSL extension: CVE-2026-91769, an overly permissive TLS host name verification, and CVE-2026-91767, an out-of-bounds read during that same check. They are rated moderate and fixed by PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11. They are not comparable to PHP2Shell, but they concern any PHP code that opens an outgoing TLS connection. Here is whether your sites are affected, which version to install on Debian, Ubuntu, RHEL, AlmaLinux, cPanel and Docker, and what to do on a branch with no fix.",[35,39,50,53,56,72,100,121,124,128,131,134,143],{"type":36,"title":37,"body":38},"h2","What these two advisories fix","Both advisories target `ext\u002Fopenssl`, the extension that handles TLS encryption for PHP streams. They do not concern the visitors of your site: they concern the connections your PHP code opens to the outside, for example a `file_get_contents('https:\u002F\u002F…')`, a `fopen` on an https URL or a `stream_socket_client` on `tls:\u002F\u002F`.\n\nIn those cases, PHP checks that the certificate presented by the remote server matches the requested host name. This is the `verify_peer_name` option, enabled by default. Both flaws sit in that check. The CVE-2026-91769 advisory (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-vvx9-73fr-5jjx\">GHSA-vvx9-73fr-5jjx\u003C\u002Fa>) describes a verification that is too permissive. The CVE-2026-91767 advisory (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-xr7j-rvgx-xq5p\">GHSA-xr7j-rvgx-xq5p\u003C\u002Fa>) describes an out-of-bounds read in the comparison of wildcard names. Both were published on the same day, 24 September 2026, and are fixed by the same versions.",{"type":40,"title":41,"items":42},"ul","The essentials in seven points",[43,44,45,46,47,48,49],"**CVE-2026-91769** — moderate severity, CVSS 3.1 score of 4.3. Peer name verification looks at the `subjectAltName` entries first, then falls back to the Common Name even when the certificate presents a DNS SAN that does not match.","**CVE-2026-91767** — moderate severity, CVSS 3.1 score of 6.5 (CWE-122). In `php_openssl_matches_wildcard_name()`, a length underflow passed to `memchr()` causes an out-of-bounds read when the certificate's wildcard name has more literal characters than the host being verified.","**Fixed versions** — PHP 8.2.34, 8.3.35, 8.4.26 and 8.5.11, for both flaws. Versions 8.4.26 and 8.5.11 appear in the PHP changelog dated 24 September 2026.","**Who is affected** — clients that rely on the default value of `verify_peer_name`, through `file_get_contents()`, `fopen()` and `stream_socket_client()` on `https:\u002F\u002F` and `tls:\u002F\u002F`.","**Workaround** — the advisory gives none. Disabling verification is not one, it is one more flaw.","**Branches 8.1 and earlier** — end of life, no upstream fix. Distribution fixes or third-party backports may exist: check package by package.","**Exploitation** — in the sources we consulted, we found no observed exploitation of these two flaws.",{"type":36,"title":51,"body":52},"What these flaws allow, and what they do not","**CVE-2026-91769 allows host spoofing.** A certificate that your client trusts for one host can be used to impersonate another one, if its Common Name contains the targeted name. RFC 6125 says to ignore the CN when a DNS SAN is present, and PHP did not. The advisory considers the case mostly relevant for private PKI, meaning an internal authority that issues certificates for many services.\n\n**CVE-2026-91767 allows a PHP client to be crashed.** A malicious server, or one with a trusted authority, can trigger the out-of-bounds read during verification: this is a denial of service. The advisory states that the outcome only affects the accept or reject decision and returns no heap content. One honest caveat: the CVSS vector rates confidentiality High and availability None, which does not match the text of the impact. We flag it without taking sides.\n\n**What they do not allow.** The advisory describes no code execution. Neither flaw is triggered by a visitor request reaching your site. Both vectors are of the adjacent network type (AV:A): the attacker must be close to the communication, not anywhere on the Internet.",{"type":36,"title":54,"body":55},"Rated moderate: is it urgent?","An honest answer: nothing in the sources we consulted indicates that these flaws are being exploited. We claim nothing beyond that. They are not comparable to PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which targets the interpreter itself and is triggered by an anonymous HTTP request. That flaw is covered separately in \u003Ca href=\"\u002Fen\u002Fblog\u002Fphp2shell-cve-2026-109618-109619-patch-php\">our PHP2Shell article\u003C\u002Fa>; the latest version of your branch, which that article asks you to install, also contains these fixes.\n\nUrgency is therefore graded. It is real if your code calls external URLs with PHP streams (payment APIs, outgoing webhooks, feed imports, licence checks) or internal services whose certificates come from a private PKI. It is much lower for a showcase site that makes no outgoing calls. In both cases the fix stays within the same branch: fit it into your next maintenance window rather than postponing it without a date.",{"type":57,"title":58,"steps":59},"steps","Measure your exposure in four steps",[60,63,66,69],{"title":61,"body":62},"Read the PHP version actually served","On the server, run `php -r 'echo PHP_VERSION, PHP_EOL;'`. Do not rely on `OPENSSL_VERSION_TEXT`: it is not the system OpenSSL library that is fixed, it is the extension code, so the PHP version is what counts. Beware, the CLI may differ from what your sites serve: on a server that hosts several branches, also read the version of each PHP-FPM pool (see the verification step below). On cPanel, the version is read per domain, see \u003Ca href=\"\u002Fen\u002Fblog\u002Fchange-php-version-site-cpanel\">our guide to the PHP selector\u003C\u002Fa>.",{"title":64,"body":65},"Look for calls that go through PHP streams","List the outgoing calls that carry a literal URL in the code: `grep -rnE \"(file_get_contents|fopen)\\(\\s*['\\\"]https?:\u002F\u002F|stream_socket_client\\(\\s*['\\\"]tls:\u002F\u002F\" \u002Fvar\u002Fwww --include='*.php'`. On a cPanel hosting account, replace `\u002Fvar\u002Fwww` with `\u002Fhome`. Complete with calls whose URL comes from a variable: `grep -rnE \"(file_get_contents|fopen|stream_socket_client)\\(\\s*\\$\" \u002Fvar\u002Fwww --include='*.php'`. Think about WordPress plugins and the `vendor` folder: outgoing calls often hide there.",{"title":67,"body":68},"Spot verifications that are already disabled","Run `grep -rn \"verify_peer_name\" \u002Fvar\u002Fwww --include='*.php'`. A value of `false` means no host name is verified at all: that code is exposed to far more than these two advisories, whatever the PHP version. Fix it before anything else.",{"title":70,"body":71},"Rank your sites","A site is a priority if it combines a branch below the floor in the table that follows and outgoing calls through streams. Calls made through the cURL extension are not cited by the advisory, which lists PHP streams. WordPress and most HTTP libraries generally use cURL when it is available, but fall back to streams otherwise: do not rule them out without checking.",{"type":73,"title":74,"headers":75,"rows":79},"comparison","Which version to install for your branch",[76,77,78],"PHP branch","Minimum fixed version","Status",[80,84,88,92,96],[81,82,83],"8.5","8.5.11","Fixed. Install the latest 8.5 available.",[85,86,87],"8.4","8.4.26","Fixed. Install the latest 8.4 available.",[89,90,91],"8.3","8.3.35","Fixed. Install the latest 8.3 available.",[93,94,95],"8.2","8.2.34","Fixed. Plan to leave this branch, see the checklist linked at the end of the article.",[97,98,99],"8.1 and earlier (5.6 to 8.1)","No upstream version","End of life. Distribution fix or third-party backport to verify, otherwise migrate.",{"type":57,"title":101,"steps":102},"Apply the fix for your environment",[103,106,109,112,115,118],{"title":104,"body":105},"Debian and Ubuntu","Refresh the index with `sudo apt update`, then upgrade the packages of your branch with `sudo apt install --only-upgrade 'php8.3*'` (replace 8.3 with your branch). To see what is pending: `apt list --upgradable 2>\u002Fdev\u002Fnull | grep -i php`. Distributions often fix through a backport without changing the upstream number: read the package log with `apt changelog php8.3-cli | grep -i CVE-2026-91769`. With a third-party repository such as Sury, the same commands apply.",{"title":107,"body":108},"RHEL, AlmaLinux and Rocky Linux","Run `sudo dnf update 'php*'`. If you use a module stream, the branch follows the enabled module: `dnf module list --enabled php` shows it. Then check the log with `rpm -q --changelog php-cli | grep -i CVE-2026-91769`. With a third-party repository, package names change: adapt the pattern to what `rpm -qa 'php*'` returns.",{"title":110,"body":111},"cPanel: EasyApache 4 and the PHP selector","EasyApache 4 branches are packages named `ea-php83`, `ea-php84`, and so on. If you have root, list them with `rpm -qa 'ea-php*' | sort` then update them with `sudo dnf update 'ea-php*'`. Read the log with `rpm -qa --changelog 'ea-php83*' | grep -i CVE-2026-91769` and the real version with `\u002Fopt\u002Fcpanel\u002Fea-php83\u002Froot\u002Fusr\u002Fbin\u002Fphp -v`. On shared hosting, the host does the update: your part is to check, in the cPanel PHP selector (MultiPHP Manager, or Select PHP Version on CloudLinux), that each domain runs on a fixed branch.",{"title":113,"body":114},"Docker","An image is not fixed in place: rebuild it, pulling the updated base, with `docker build --pull --no-cache -t your-image .`, or `docker compose build --pull --no-cache` with Compose, then restart with `docker compose up -d`. Check the result inside the container with `docker run --rm your-image php -v`. A floating tag such as `php:8.4-fpm` only moves if the upstream image was rebuilt: the printed number is what counts, not the tag name.",{"title":116,"body":117},"Restart the PHP services","PHP-FPM and Apache keep the old code in memory until they are reloaded. On Debian or Ubuntu: `sudo systemctl restart php8.3-fpm` (adapt the branch), and `sudo systemctl restart apache2` if you use `mod_php`. On RHEL or AlmaLinux: `sudo systemctl restart httpd`. On cPanel with PHP-FPM, `systemctl list-units 'ea-php*'` gives the exact name of the service to restart.",{"title":119,"body":120},"Check the version actually served","The CLI is not the web service. Query the FPM binary: `php-fpm8.3 -v` on Debian and Ubuntu, `php-fpm -v` on RHEL and derivatives, or the domain's version in cPanel. The number must reach the floor of your branch, or its log must cite CVE-2026-91769. Finish with a test outgoing call: `php -r 'echo strlen(file_get_contents(\"https:\u002F\u002Fyour-domain.com\u002F\")), PHP_EOL;'`.",{"type":36,"title":122,"body":123},"If your branch is end of life (8.1 and earlier)","According to \u003Ca href=\"https:\u002F\u002Fwww.herodevs.com\u002Fvulnerability-directory\u002Fcve-2026-91767\">HeroDevs\u003C\u002Fa>, PHP branches 5.6 to 8.1 are end of life and receive no upstream fix for these flaws. Do not assume anything either way. Your distribution may have backported the fix into its package: it is possible, it is not guaranteed, and it is checked package by package, with the change log (`apt changelog`, `rpm -q --changelog`) and the distribution's security tracker. Third-party vendors also offer backports for abandoned versions.\n\nWithout a confirmed fix, you have three levers. The first is migrating to a maintained branch, 8.3 or 8.4 after testing your site: the method is in \u003Ca href=\"\u002Fen\u002Fblog\u002Fphp-82-end-of-life-planning-your-migration\">our PHP migration checklist\u003C\u002Fa>. The second is to limit the outgoing calls of that code to hosts whose certificates you control. The third is to restrict the server's outgoing traffic at the firewall. The last two reduce exposure, they fix nothing.",{"type":125,"title":126,"body":127},"tip","Never set verify_peer_name to false","Faced with a certificate error, the temptation is to add `verify_peer_name => false` in a `stream_context_create`. That is worse than the flaw: no host name is verified anymore, so any trusted certificate passes for any host. The advisory gives no workaround, and this option is not one. When a connection fails after the update, repair the certificate.",{"type":36,"title":129,"body":130},"A third OpenSSL fix in the same quarter","CVE-2026-14355 is a separate flaw: memory corruption in `openssl_encrypt()` with the AES-WRAP-PAD algorithm (GH-22187). According to the PHP changelog (\u003Ca href=\"https:\u002F\u002Fwww.php.net\u002FChangeLog-8.php\">https:\u002F\u002Fwww.php.net\u002FChangeLog-8.php\u003C\u002Fa>), it is fixed in PHP 8.4.23, dated 3 July 2026, and in PHP 8.5.8, dated 2 July 2026. It affects encryption, not TLS verification: it changes nothing in the exposure test above.\n\nIf you install 8.4.26 or 8.5.11 or later, you already have this fix. For branches 8.2 and 8.3, we do not cite a version, as we have not verified it: read your package log to see whether CVE-2026-14355 appears in it.",{"type":36,"title":132,"body":133},"Troubleshooting after the update","The fix tightens a check. Some calls that used to pass may therefore fail now, and that is the expected consequence of the fix, not a regression. The case to test first is an internal service whose certificate comes from a private authority. Here are the real messages you may meet and the matching remedy.",{"type":40,"title":135,"items":136},"Errors you may meet and their remedies",[137,138,139,140,141,142],"**`SSL operation failed with code 1` then `certificate verify failed`** — typical full message: `stream_socket_client(): SSL operation failed with code 1. OpenSSL Error messages: error:0A000086:SSL routines::certificate verify failed`. Probable cause: the certificate presents a DNS SAN that does not contain the host being called, but its CN does. The old check accepted it by falling back to the CN, the new one rejects it. Read the certificate with `openssl s_client -connect interne.your-domain.com:443 -servername interne.your-domain.com \u003C\u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | openssl x509 -noout -subject -ext subjectAltName`. Remedy: reissue the certificate with a correct DNS SAN for every name used, never disable verification.","**`file_get_contents(): Failed to enable crypto`** — warning that accompanies the previous one. Read the full message that follows: depending on the version, you may also find `Peer certificate CN=… did not match expected CN=…`. Same cause, same remedy.","**A certificate with no SAN at all, only a CN, still fails** — the fix keeps the CN fallback for certificates without a service identifier. The cause is therefore elsewhere: authority not trusted by the client, host called by an alias or an IP address missing from the certificate, expired certificate. Remedy: add the internal authority to `cafile` in the stream context, and reissue the certificate with a SAN.","**`child exited on signal 11 (SIGSEGV)` in the PHP-FPM log** — a worker crashing during an outgoing TLS call is compatible with CVE-2026-91767. Do not conclude from that sign alone: check the version, update and see whether the pattern disappears.","**`php -v` still shows the old version** — service not restarted, CLI and FPM on different branches, Docker image rebuilt without `--pull`, or the domain's version unchanged in cPanel. Go back to the verification step.","**The distribution log does not cite the CVE** — its absence proves neither that the fix is there nor that it is missing. Consult the distribution's security tracker, and failing that compare the upstream number with the floor in the table.",{"type":57,"title":144,"steps":145},"Build the update into your routine",[146,149,152,155],{"title":147,"body":148},"Record the floor in your inventory","Add a \"minimum version\" column per branch to your fleet inventory, with the values from the table. A version below the floor then becomes visible without any research.",{"title":150,"body":151},"Schedule PHP updates","A PHP security fix is a minor update within the same branch: plan a regular slot rather than a project for each advisory, with a service restart and a check of the version served.",{"title":153,"body":154},"Test an outgoing call after each update","Replay `php -r 'echo strlen(file_get_contents(\"https:\u002F\u002Fyour-domain.com\u002F\")), PHP_EOL;'` from each server, and a call to your internal services. A certificate error then shows up immediately, not at a customer's.",{"title":156,"body":157},"Connect this fix to the rest of your monitoring","For the method of surveying a fleet, read \u003Ca href=\"\u002Fen\u002Fblog\u002Fphp-version-inventory-for-client-sites-an-agency-method\">the PHP version inventory for a client fleet\u003C\u002Fa>. For the most critical flaw of the moment, see \u003Ca href=\"\u002Fen\u002Fblog\u002Fphp2shell-cve-2026-109618-109619-patch-php\">PHP2Shell\u003C\u002Fa>. To change a site's version, follow \u003Ca href=\"\u002Fen\u002Fblog\u002Fchange-php-version-site-cpanel\">the cPanel PHP selector guide\u003C\u002Fa>. For a branch that is ending, go back to \u003Ca href=\"\u002Fen\u002Fblog\u002Fphp-82-end-of-life-planning-your-migration\">the PHP 8.2 migration checklist\u003C\u002Fa>.","Choose the PHP version of each site","On a ServOrbit.com web hosting plan, you choose the PHP version domain by domain from cPanel, and you move to a branch that is still fixed after testing your site.","Discover web hosting","\u002Fhebergement-web",[163,180,196,216],{"id":164,"slug":165,"slugs":166,"title":170,"excerpt":171,"readTime":172,"views":173,"isPinned":19,"publishedAt":174,"updatedAt":175,"category":176,"categories":177,"featuredImage":30,"bgImage":31,"posterImage":179,"relatedSolution":30},489,"php2shell-cve-2026-109618-109619-patch-php",{"fr":167,"en":165,"ar":168,"es":169},"php2shell-cve-2026-109618-109619-mettre-a-jour-php","php2shell-cve-2026-109618-109619-تحديث-php","php2shell-cve-2026-109618-109619-actualizar-php","PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619","PHP2Shell: two critical PHP flaws exploitable without an account. Patched versions, update commands per system and temporary mitigations.",16,1,"2026-10-22T00:00:00+00:00","2026-10-27T23:58:43+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[178],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fphp2shell-cve-2026-109618-109619-mettre-a-jour-php-poster.svg",{"id":181,"slug":182,"slugs":183,"title":187,"excerpt":188,"readTime":189,"views":18,"isPinned":19,"publishedAt":190,"updatedAt":191,"category":192,"categories":193,"featuredImage":30,"bgImage":31,"posterImage":195,"relatedSolution":30},508,"php-version-inventory-for-client-sites-an-agency-method",{"fr":184,"en":182,"ar":185,"es":186},"inventaire-versions-php-parc-sites-clients-agence","جرد-إصدارات-php-لمواقع-العملاء-منهج-للوكالات","inventario-de-versiones-php-de-sitios-cliente-metodo-de-agencia","PHP version inventory for client sites: an agency method","Build a register of the PHP version served by every client site across several hosts: access tiers, batch scripts, priority batches, client message, dated proof.",11,"2026-10-27T00:00:00+00:00","2026-10-27T23:58:39+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[194],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Finventaire-versions-php-parc-sites-clients-agence-poster.svg",{"id":197,"slug":198,"slugs":199,"title":203,"excerpt":204,"readTime":205,"views":173,"isPinned":19,"publishedAt":206,"updatedAt":207,"category":208,"categories":213,"featuredImage":30,"bgImage":31,"posterImage":215,"relatedSolution":30},503,"change-php-version-site-cpanel",{"fr":200,"en":198,"ar":201,"es":202},"changer-version-php-site-cpanel","تغيير-إصدار-php-للموقع-في-cpanel","cambiar-version-php-sitio-cpanel","Change your site's PHP version in cPanel","Choose your site's PHP version in cPanel: open the site page, the Settings tab, then pick the version you want from the list.",3,"2026-10-23T00:00:00+00:00","2026-10-24T03:34:36+00:00",{"id":209,"name":210,"slug":211,"color":212,"icon":211},12,"Guides","guides","bg-emerald-500\u002F10 text-emerald-400",[214],{"id":209,"name":210,"slug":211,"color":212,"icon":211},"\u002Fblog\u002Fcovers\u002Fchanger-version-php-site-cpanel-poster.svg",{"id":217,"slug":218,"slugs":219,"title":223,"excerpt":224,"readTime":189,"views":225,"isPinned":19,"publishedAt":226,"updatedAt":227,"category":228,"categories":234,"featuredImage":30,"bgImage":31,"posterImage":236,"relatedSolution":30},206,"php-82-end-of-life-planning-your-migration",{"fr":220,"en":218,"ar":221,"es":222},"php-82-fin-de-vie-checklist-migration","نهاية-دعم-php-82-دليل-الترحيل","php-82-fin-de-vida-planificar-la-migracion","PHP 8.2 end of life: your migration checklist","PHP 8.2 reaches EOL on December 31, 2026. Inventory your stack, compare PHP versions, and follow a step-by-step migration checklist to PHP 8.3 or 8.4.",7,"2026-08-01T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":229,"name":230,"slug":231,"color":232,"icon":233},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[235],{"id":229,"name":230,"slug":231,"color":232,"icon":233},"\u002Fblog\u002Fcovers\u002Fphp-82-fin-de-vie-checklist-migration-poster.svg",1793758459217]