Back Linuxsecurity

Fedora 42 php-phpseclib3 Important Security Alert CVE-2026

Linuxsecurity •LinuxSecurity Advisories • March 30, 2026

MIT-licensed pure-PHP implementations of an arbitrary-precision integer arithmetic library, fully PKCS#1 (v2.1) compliant RSA, DES, 3DES, RC4, Rijndael, AES, Blowfish, Twofish, SSH-1, SSH-2, SFTP, and X.509 Update Information : Update to v3.0.50; contains fix for CVE-2026-32935

MIT-licensed pure-PHP implementations of an arbitrary-precision integer

arithmetic library, fully PKCS#1 (v2.1) compliant RSA, DES, 3DES, RC4,

Rijndael, AES, Blowfish, Twofish, SSH-1, SSH-2, SFTP, and X.509

Update to v3.0.50; contains fix for CVE-2026-32935

* Sat Mar 21 2026 Artur Frenszek-Iwicki - 3.0.50-1 - Update to v3.0.50

[ 1 ] Bug #2448961 - php-phpseclib3-3.0.50 is available [ 2 ] Bug #2449634 - CVE-2026-32935 php-phpseclib3: phpseclib: Information disclosure via padding oracle timing attack when using AES in CBC mode [fedora-42]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-65fdd15133' at the command line. For more information, refer to the dnf documentation available at

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Info Disclosure Vulnerability in phpseclib for Fedora 42 and 43 A critical information disclosure vulnerability (CVE-2026-32935) was identified in the phpseclib library, affecting Fedora 42 and 43. The vulnerability allows attackers to exploit a padding oracle timing attack when using AES in CBC mode, potentially disclosing sensitive information. The issue was published on 2026-03-20 and has been addressed in updates for both Fedora versions. Fedora 43 has been updated to version 3.0.50, while Fedora 42 has been updated to version 2.0.52 to mitigate the risk. Users are advised to apply the updates immediately to protect against potential exploitation. The updates can be installed using the 'dnf' package manager. The vulnerability impacts systems utilizing the affected versions of phpseclib, which is widely used for cryptographic operations in PHP applications. Failure to update may leave systems vulnerable to attacks that exploit this flaw. 3 sources 73

Extracted Entities

Companies (1)

Fedora

CVEs (1)

CVE-2026-32935