CVE-2026-91768: 
PHP vulnerability analysis and mitigation

CVE-2026-91768 is an IPv6 access control bypass vulnerability in PHP-FPM's FastCGI client access check (listen.allowed_clients). The flaw causes the fcgi_is_allowed() function in main/fastcgi.c to compare only the first 12 bytes (96 bits) of a 16-byte IPv6 address instead of the full address, effectively widening every configured ACL entry to a /96 network prefix. It affects PHP-FPM versions prior to 8.2.34, 8.3.35, 8.4.26, and 8.5.11, and was disclosed on September 24, 2026. The CVSS v3.1 base score is 6.5 (Moderate) (GitHub Advisory).

The root cause is an improper access control check (CWE-284) in fcgi_is_allowed() within main/fastcgi.c, where a hard-coded memcmp length of 12 is used for IPv6 address comparison instead of the required 16 bytes (sizeof(struct in6_addr)). This means any attacker whose IPv6 source address shares the first 96 bits with a legitimately allowed client address will pass the ACL check. The IPv4 branch correctly compares all 4 bytes, and the IN6_IS_ADDR_V4MAPPED branch legitimately uses a 12-byte offset for a different purpose — but that offset was incorrectly reused as the comparison length for plain IPv6 addresses. Allowed addresses are parsed correctly via inet_pton(AF_INET6, ...), so the truncation silently widens every configured entry to a /96 prefix without any visible configuration error. A proof-of-concept was confirmed against a real php-fpm instance: configuring listen.allowed_clients = ::2 and connecting from ::1 (which shares the first 96 bits) results in the connection being accepted and the PHP script executing (GitHub Advisory).

Successful exploitation allows an attacker with network adjacency to bypass the listen.allowed_clients ACL and reach the FastCGI endpoint, which in typical deployments means the ability to execute arbitrary PHP scripts in the FPM worker context. The primary impact is a high confidentiality risk, as unauthorized script execution can expose sensitive application data, configuration files, or environment variables. Integrity and availability are not directly impacted by the bypass itself. Deployments using Unix domain sockets, IPv4-only configurations, or an external firewall as the primary network boundary are not affected (GitHub Advisory).

A working proof-of-concept has been confirmed by the reporter against a real php-fpm instance, demonstrating that an attacker sourcing traffic from an IPv6 address sharing the first 96 bits with an allowed client can bypass the ACL. The CVE status is currently "Reserved" with limited public details, and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. No EPSS score or CISA KEV catalog entry has been reported. The attack vector is Adjacent Network with no privileges or user interaction required (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target server running PHP-FPM with FastCGI exposed over an IPv6 TCP socket (e.g., listen = [::1]:9000) and listen.allowed_clients configured with one or more IPv6 addresses.
2. Determine allowed client prefix: Identify or guess an IPv6 address listed in listen.allowed_clients (e.g., ::2). Extract its first 96 bits (first 12 bytes), which is the effective ACL boundary due to the bug.
3. Craft a source address: Obtain or spoof an IPv6 source address that shares the first 96 bits with the allowed address (e.g., ::1 shares the first 96 bits with ::2 since both are in the ::0/96 prefix).
4. Send a FastCGI request: Using a FastCGI client tool (e.g., cgi-fcgi, fcgi-client, or a custom script), connect to the PHP-FPM listening socket from the crafted source address and send a valid FastCGI request specifying a target PHP script via SCRIPT_FILENAME.
5. Achieve script execution: The partial memcmp passes the ACL check, and PHP-FPM executes the requested script in the FPM worker context, returning the output to the attacker (GitHub Advisory).

• Network: Unexpected FastCGI connections to PHP-FPM listening ports (default 9000) originating from IPv6 addresses not explicitly listed in listen.allowed_clients but sharing the same /96 prefix; unusual traffic patterns on FastCGI ports from non-web-server source addresses.
• Logs: PHP-FPM access logs (/var/log/php-fpm/access.log) showing script execution requests from unexpected IPv6 source addresses; FPM error logs showing connections from addresses outside the expected allowed set.
• Process: PHP-FPM worker processes executing scripts not triggered by the legitimate web server (e.g., nginx or Apache), particularly scripts that access sensitive files or spawn child processes.

PHP has released patched versions that fix the comparison to use sizeof(client_sa.sa_inet6.sin6_addr) (all 16 bytes): 8.2.34, 8.3.35, 8.4.26, and 8.5.11. Upgrading to one of these versions is the recommended remediation. As a workaround for environments that cannot immediately upgrade, administrators should restrict FastCGI access using an external firewall or network-level controls rather than relying solely on listen.allowed_clients, or switch to Unix domain sockets which are not affected by this vulnerability (GitHub Advisory, PHP 8.4.26 NEWS).

The vulnerability was published by the PHP security team (bukka) on September 24, 2026, with fix credit to Alexandre Daubois (developer) and reporters iluuu1994 and iliaal. The Remi repository blog noted the patched releases for RHEL and Fedora shortly after disclosure. Security news outlet SecurityOnline.info covered the PHP vulnerability patch batch. Community discussion has been limited given the "Reserved" CVE status and moderate severity rating (Remi's Blog, SecurityOnline).