Multiple PHP Vulnerabilities Enable DoS and Memory Corruption Attacks

Cybersecuritynews •Abinaya • July 6, 2026

Multiple security vulnerabilities in PHP have been disclosed that could allow attackers to trigger denial-of-service (DoS) conditions and cause memory corruption, impacting widely deployed web applications. The issues, tracked as CVE-2026-12184 and CVE-2026-14355, were published through official PHP security advisories and affect several active branches of the language runtime. The most severe issue, CVE-2026-12184, is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Enable DoS Attacks on Web Applications Two critical vulnerabilities in PHP, CVE-2026-12184 and CVE-2026-14355, have been disclosed, posing significant risks to web applications. CVE-2026-12184 allows attackers to trigger denial-of-service (DoS) conditions by exploiting flaws in PHP's HTTP stream-handling logic during TLS initialization failures. This can lead to crashes of the PHP FastCGI Process Manager (PHP-FPM), affecting multiple PHP versions prior to 8.3.32, 8.4.21, and 8.5.6. The second vulnerability, CVE-2026-14355, involves memory corruption in PHP's OpenSSL extension due to improper buffer sizing, which could also lead to application instability. Both vulnerabilities have been patched, and users are urged to update their PHP installations immediately to mitigate risks. The vulnerabilities were identified through automated analysis techniques, highlighting the importance of robust security practices in web development. 4 sources 74

Extracted Entities

Multiple PHP Vulnerabilities Enable DoS and Memory Corruption Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (1)