Back Linuxsecurity

Ubuntu 26.04 PHP Significant Denial of Service Flaws USN-8564

Linuxsecurity •LinuxSecurity Advisories • July 20, 2026

Several security issues were fixed in PHP. Software Description: - php8.5: HTML-embedded scripting language interpreter - php8.3: HTML-embedded scripting language interpreter - php8.1: HTML-embedded scripting language interpreter Details: It was discovered that PHP incorrectly handled certain TLS setup failures, resulting in a NULL pointer dereference. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-12184) It was discovered that PHP contained a buffer allocation flaw in the OpenSSL extension when using the AES-WRAP-PAD algorithm. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-14355)

Several security issues were fixed in PHP.

Software Description:

- php8.5: HTML-embedded scripting language interpreter

- php8.3: HTML-embedded scripting language interpreter

- php8.1: HTML-embedded scripting language interpreter

It was discovered that PHP incorrectly handled certain TLS setup failures,

resulting in a NULL pointer dereference. An attacker could possibly use

this issue to cause PHP to crash, resulting in a denial of service. This

issue only affected Ubuntu 26.04 LTS. (CVE-2026-12184)

It was discovered that PHP contained a buffer allocation flaw in the

OpenSSL extension when using the AES-WRAP-PAD algorithm. An attacker could

use this issue to cause PHP to crash, resulting in a denial of service, or

possibly execute arbitrary code. (CVE-2026-14355)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS php8.5 8.5.4-0ubuntu1.2 Ubuntu 24.04 LTS php8.3 8.3.6-0ubuntu0.24.04.10 Ubuntu 22.04 LTS php8.1 8.1.2-1ubuntu2.25 In general, a standard system update will make all the necessary changes.

CVE-2026-12184, CVE-2026-14355

Ubuntu Security Notice USN-8564-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities in Ubuntu 26.04 LTS Lead to Denial of Service Risks On July 20, 2026, multiple vulnerabilities in PHP were disclosed, affecting Ubuntu 26.04 LTS. The vulnerabilities include a NULL pointer dereference (CVE-2026-12184) and a buffer allocation flaw in the OpenSSL extension (CVE-2026-14355). Both issues could lead to denial of service attacks or potentially allow arbitrary code execution. The vulnerabilities were confirmed to impact various PHP versions, including 8.5, 8.3, and 8.1. Users are advised to update their systems to mitigate these risks. The vulnerabilities were published on July 3, 2026. The PHP issues have been addressed in recent security updates. Administrators are encouraged to apply the patches immediately to ensure system security. 4 sources 72

Extracted Entities

Ubuntu 26.04 PHP Significant Denial of Service Flaws USN-8564

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

CWE Weaknesses (1)

Tools (1)