PHP TLS Flaw Lets Remote Server Trigger DoS and Crash Entire FPM Process

Gbhackers •Divya • July 6, 2026

A newly disclosed high-severity vulnerability in PHP, tracked as CVE-2026-12184, poses a significant risk to web applications by allowing a remotely triggerable denial-of-service (DoS) condition. This vulnerability can cause entire PHP-FPM process pools to crash. Details of the issue are outlined in the GitHub advisory GHSA-mhmq-mmqj-2v39. It affects multiple supported PHP branches, including versions before […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Enable DoS Attacks on Web Applications Two critical vulnerabilities in PHP, CVE-2026-12184 and CVE-2026-14355, have been disclosed, posing significant risks to web applications. CVE-2026-12184 allows attackers to trigger denial-of-service (DoS) conditions by exploiting flaws in PHP's HTTP stream-handling logic during TLS initialization failures. This can lead to crashes of the PHP FastCGI Process Manager (PHP-FPM), affecting multiple PHP versions prior to 8.3.32, 8.4.21, and 8.5.6. The second vulnerability, CVE-2026-14355, involves memory corruption in PHP's OpenSSL extension due to improper buffer sizing, which could also lead to application instability. Both vulnerabilities have been patched, and users are urged to update their PHP installations immediately to mitigate risks. The vulnerabilities were identified through automated analysis techniques, highlighting the importance of robust security practices in web development. 4 sources 74

Extracted Entities

Attack Types (1)

DDoS

CVEs (1)

CVE-2026-12184