PHP shipped four coordinated releases on September 24, 2026: 8.5.11, 8.4.26, 8.3.35, and 8.2.34, covering every actively supported branch of the language. Together they close ten CVEs, including an IPv6 ACL bypass in PHP-FPM’s FastCGI listener and a TLS hostname verification bug that quietly falls back to a weaker check after the proper one fails. If PHP runs anywhere in your stack, a WordPress install, a custom backend, an internal API, this is worth a patch this week rather than the next scheduled maintenance window.
What Actually Broke
Two of the ten fixes matter more than the rest because they touch decisions PHP makes about trust, not just edge-case crashes.
CVE-2026-91768 sits in PHP-FPM’s listen.allowed_clients directive, the setting a lot of hosting setups lean on to restrict which IP addresses can reach the FastCGI socket directly. According to PHP’s own GHSA-62xp-839h-2637 advisory, the ACL check does a partial address comparison, which means an IPv6 client can slip past a rule written for a different textual form of the same address. The fix landed identically across 8.5.11, 8.4.26, 8.3.35, and 8.2.34, so it isn’t a quirk of one branch, it’s the same FPM code in all of them.
CVE-2026-91769 is in the OpenSSL extension: TLS hostname verification can fall back to matching a certificate’s Common Name after the Subject Alternative Name check fails, instead of rejecting the connection outright. A related bug, CVE-2026-91767, is a heap buffer overflow in that same wildcard-matching code when a server hands back a crafted certificate. Between the two, any PHP code that opens outbound HTTPS connections, curl, stream wrappers, SOAP clients, gets a real change in how hard it is for a misconfigured or malicious endpoint to pass as trusted.
The Rest of the Patch Set
The same release closes a cross-origin credential leak in the HTTP stream wrapper’s redirect handling (CVE-2026-91766), an integer overflow in Phar’s TAR handling that let a crafted archive inject extra entries (CVE-2026-6103), unbounded recursion in SOAP’s server-side cleanup that a malformed request could use to exhaust memory (CVE-2026-91765), an older SOAP HTTP parsing overflow (CVE-2025-14181), packet overreads in the mysqlnd wire protocol (CVE-2025-1218), and two out-of-bounds reads affecting stream filters and the HTTP wrapper (CVE-2026-92842, CVE-2026-93682). Windows builds also pick up a fix for reserved device names slipping through file and stream I/O (CVE-2026-17545).
None of this touches PHP 8.6, which is still a preview. The project shipped 8.6.0 RC2 the same day, a feature-frozen build meant for testing, not production.
Who Should Actually Patch, and How
If your hosting stack is still on PHP 8.1 or earlier, none of these specific fixes apply to you because that line is past end of life, and that’s the bigger problem to deal with first. For everyone on a supported branch, the fix is a routine version bump: move to 8.5.11, 8.4.26, 8.3.35, or 8.2.34 depending on where you sit, restart php-fpm, and confirm the new version is actually live.
Most managed WordPress hosts will roll this out on their own schedule, but it’s worth checking rather than assuming, especially if you manage a VPS or dedicated server yourself. Our WordPress Development team treats PHP version and patch level as a standard line item in any site audit, since a stale PHP branch underneath an otherwise well-kept site is one of the more common things we find. For custom PHP backends outside WordPress, this kind of dependency patching is exactly what our Web Application Development team keeps on a schedule instead of leaving to whoever happens to notice first.
Sources
- PHP 8.5.11 Released – php.net official release announcement
- PHP 8.4.26 Released – php.net official release announcement
- PHP 8.3.35 Released – php.net official release announcement
- PHP 8.2.34 Released – php.net official release announcement
- PHP 8.5.11 Changelog – full list of fixes and CVE references
- GHSA-62xp-839h-2637 (CVE-2026-91768) – FPM FastCGI IPv6 ACL bypass advisory
- GHSA-vvx9-73fr-5jjx (CVE-2026-91769) – TLS hostname verification fallback advisory
