{"uuid": "5397aea5-0e10-4649-b08f-71830735e0a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-MHMQ-MMQJ-2V39", "type": "seen", "source": "https://t.me/pphm_HackerNews/1832", "content": "\ud83d\udd34 PHP TLS Flaw Lets Remote Server Trigger DoS and Crash Entire FPM Process\n\nA newly disclosed high-severity vulnerability in PHP, tracked as CVE-2026-12184, poses a significant risk to web applications by allowing a remotely triggerable denial-of-service (DoS) condition.\n\nThis vulnerability can cause entire PHP-FPM process pools to crash. Details of the issue are outlined in the GitHub advisory GHSA-mhmq-mmqj-2v39. It affects multiple supported PHP branches, including versions before 8.3.32, 8.4.21, and 8.5.6.\n\nThe flaw lies in the HTTP stream-handling logic, specifically in the php_stream_url_wrap_http_ex function.", "creation_timestamp": "2026-08-23T00:00:43.450507Z"}