On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.

According to its self-reported version number, the version of PHP installed on the remote host is 8.2.x prior to 8.2.34, 8.3.x prior to 8.3.35, 8.4.x prior to 8.4.26, or 8.5.x prior to 8.5.11. It is, therefore, affected by multiple vulnerabilities:

 - Various packet overreads in the MySQLnd wire protocol implementation. (CVE-2025-1218)

 - Integer overflow leading to a buffer overflow in SOAP HTTP parsing. (CVE-2025-14181)

 - Integer overflow in phar_tar_number() in Phar allowing TAR archive entry injection. (CVE-2026-6103)

 - Reserved device names are not rejected before file and stream I/O on Windows. (CVE-2026-17545)

 - Unbounded recursion in server-side cleanup_xml_node() in SOAP. (CVE-2026-91765)

 - Cross-origin credential leak in HTTP stream wrapper redirects. (CVE-2026-91766)

 - Heap buffer overflow in php_openssl_matches_wildcard_name() in OpenSSL on a crafted server certificate wildcard CN. (CVE-2026-91767)

 - IPv6 ACL bypass in FPM FastCGI listen.allowed_clients due to partial address comparison. (CVE-2026-91768)

 - TLS hostname verification in OpenSSL falls back to CN after a SAN mismatch. (CVE-2026-91769)

 - Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL. (CVE-2026-92842)

 - Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header. (CVE-2026-93682)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX,     NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An     attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular     file the application expected, which can block or hang the request and exhaust worker processes.
    (CVE-2026-17545)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of php82 installed on the remote host is prior to 8.2.34 / 8.5.11. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-267-01 advisory.

    New php packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the php82 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.4.26. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.26 advisory.

  - Debian Linux - php8.2 - None  php8.4 - None (CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765,     CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.34. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.34 advisory.

  - Debian Linux - php8.2 - None  php8.4 - None (CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765,     CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.35. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.35 advisory.

  - Debian Linux - php8.2 - None  php8.4 - None (CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765,     CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.5.11. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.11 advisory.

  - Debian Linux - php8.2 - None  php8.4 - None (CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765,     CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115553	PHP 8.2.x < 8.2.34 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115552	PHP 8.3.x < 8.3.35 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115551	PHP 8.4.x < 8.4.26 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115550	PHP 8.5.x < 8.5.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
350226	Linux Distros Unpatched Vulnerability : CVE-2026-17545	Nessus	Misc.	Local	medium
350079	Slackware Linux 15.0 / current php82 Multiple Vulnerabilities (SSA:2026-267-01)	Nessus	Slackware Local Security Checks	Local	medium
349788	PHP 8.4.x < 8.4.26 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium
349787	PHP 8.2.x < 8.2.34 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium
349675	PHP 8.3.x < 8.3.35 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium
349674	PHP 8.5.x < 8.5.11 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2026-17545

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium