--- title: "USN-8564-1: PHP vulnerabilities | Ubuntu security notices\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/notices/USN-8564-1?format=md keywords: index, follow --- 1. [Ubuntu Security Notices](https://ubuntu.com/security/notices) 2. USN-8564-1 --- # USN-8564-1: PHP vulnerabilities Publication date 20 July 2026 Overview Several security issues were fixed in PHP. Releases [26.04 LTS](https://ubuntu.com/security/notices?release=resolute) [24.04 LTS](https://ubuntu.com/security/notices?release=noble) [22.04 LTS](https://ubuntu.com/security/notices?release=jammy) --- Open side navigation ## Packages * [php8.1](https://ubuntu.com/security/cves?package=php8.1) - HTML-embedded scripting language interpreter * [php8.3](https://ubuntu.com/security/cves?package=php8.3) - HTML-embedded scripting language interpreter * [php8.5](https://ubuntu.com/security/cves?package=php8.5) - HTML-embedded scripting language interpreter ## Details It was discovered that PHP incorrectly handled certain TLS setup failures, resulting in a NULL pointer dereference. An attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. ([CVE-2026-12184](https://ubuntu.com/security/CVE-2026-12184)) It was discovered that PHP contained a buffer allocation flaw in the OpenSSL extension when using the AES-WRAP-PAD algorithm. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. ([CVE-2026-14355](https://ubuntu.com/security/CVE-2026-14355)) ## Update instructions In general, a standard system update will make all the necessary changes. [Learn more about how to get the fixes.](https://ubuntu.com/security/cves/about#security) The problem can be corrected by updating your system to the following package versions: | Ubuntu Release | Package Version | | --- | --- | | 26.04 LTS resolute | [php8.5](https://launchpad.net/ubuntu/+source/php8.5) –  [8.5.4-0ubuntu1.2](https://launchpad.net/ubuntu/+source/php8.5/8.5.4-0ubuntu1.2) | | | | 24.04 LTS noble | [php8.3](https://launchpad.net/ubuntu/+source/php8.3) –  [8.3.6-0ubuntu0.24.04.10](https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.24.04.10) | | | | 22.04 LTS jammy | [php8.1](https://launchpad.net/ubuntu/+source/php8.1) –  [8.1.2-1ubuntu2.25](https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.25) | | | --- ### Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. [Get Ubuntu Pro](https://ubuntu.com/pro) ## References * [CVE-2026-14355](https://ubuntu.com/security/CVE-2026-14355) * [CVE-2026-12184](https://ubuntu.com/security/CVE-2026-12184)