Related incident · OpenSSL advisories · January–September 2026

OpenSSL high-severity vulnerabilities in 2026 and what they mean for PHP

PHP’s openssl and curl extensions call the system OpenSSL library. Updating PHP does not update OpenSSL; the library has its own security releases.

Last updated 2026-10-22

High-severity OpenSSL advisories in 2026

From OpenSSL’s own advisories

CVE	Published	Issue	Fixed in
CVE-2025-15467	27 Jan 2026	Stack buffer overflow in CMS (Auth)EnvelopedData parsing; pre-authentication; DoS or potentially RCE	3.6.1, 3.5.5, 3.4.4, 3.3.6, 3.0.19
CVE-2026-45447	9 Jun 2026	Heap use-after-free in PKCS7_verify() for crafted PKCS#7 / S/MIME	4.0.1, 3.6.3, 3.5.7, 3.4.6, 3.0.21
CVE-2026-84782	29 Sep 2026	DTLS retransmission out-of-bounds read; heap disclosure or crash	4.0.3, 3.6.5, 3.5.9, 3.4.8

Which OpenSSL does my PHP use?

Check the linked library

# Which OpenSSL is PHP linked against?
php -i | grep -i -E '^openssl|OpenSSL Library|OpenSSL Header'
openssl version
# Distribution packages often backport fixes without changing the upstream number:
apt-cache policy openssl libssl3     # Debian / Ubuntu
rpm -q openssl openssl-libs          # RHEL family

How to fix it

Update the distribution’s OpenSSL packages (libssl3 / openssl-libs) and restart PHP-FPM, Apache and long-running workers so they load the new library.
For Docker, rebuild on a current base image tag; an old image keeps its old libssl.
For bundled stacks with their own OpenSSL DLLs or libraries, install the vendor’s updated build.

FAQ

Does upgrading PHP fix OpenSSL bugs?

Usually not. Distribution PHP packages link against the system libssl, so you update the OpenSSL package. Static or bundled builds (some Windows and all-in-one stacks) carry their own OpenSSL and need a new build from the vendor.

Is a typical PHP website exposed?

It depends on what the code does. CVE-2025-15467 and CVE-2026-45447 involve parsing CMS or PKCS#7 messages, such as S/MIME, which PHP exposes through functions like openssl_cms_decrypt() and openssl_pkcs7_verify(). We have not seen a public report of a PHP-specific attack path; patch the library either way.

My distribution shows an older OpenSSL number. Am I vulnerable?

Not necessarily. Debian, Ubuntu and RHEL backport fixes without changing the upstream version, so check the CVE in your distribution’s security tracker.

Sources

Outbound links leave this site. We do not host exploit code.

OpenSSL Security Advisory, 27 January 2026 (CVE-2025-15467) — OpenSSL
OpenSSL Security Advisory, 9 June 2026 (CVE-2026-45447) — OpenSSL
OpenSSL Security Advisory, 29 September 2026 (CVE-2026-84782) — OpenSSL
Vulnerabilities list — OpenSSL
OpenSSL runtime configuration (openssl.cafile, openssl.capath) — PHP manual