· adswds team · Security
PHP-FPM’s IPv6 allow-list compared 12 bytes: CVE-2026-91768
24 Sep 2026 PHP security release: listen.allowed_clients compares only the first 12 bytes of an IPv6 address, widening an exact host to a /96. Fixed in 8.2.34, 8.3.35, 8.4.26, and 8.5.11. Unix sockets and IPv4-only listeners are out of scope.