{"id":2963,"date":"2026-07-07T10:57:22","date_gmt":"2026-07-07T10:57:22","guid":{"rendered":"https:\/\/www.serverspan.com\/blog\/"},"modified":"2026-07-07T11:01:53","modified_gmt":"2026-07-07T11:01:53","slug":"cve-2026-12184-ghid-de-patch-pentru-dos-in-php-fpm-8-3-32-8-4-21-8-5-6","status":"publish","type":"post","link":"https:\/\/www.serverspan.ro\/blog\/cve-2026-12184-ghid-de-patch-pentru-dos-in-php-fpm-8-3-32-8-4-21-8-5-6\/","title":{"rendered":"CVE-2026-12184: Ghid de Patch pentru DoS \u00een PHP-FPM (8.3.32 \/ 8.4.21 \/ 8.5.6)"},"content":{"rendered":"\n\n<p class=\"wp-block-paragraph\">Dou\u0103 buletine de securitate PHP publicate pe 2 iulie 2026 remediaz\u0103 o vulnerabilitate denial-of-service cu severitate ridicat\u0103 \u0219i un bug de corupere a memoriei cu severitate moderat\u0103. CVE-2026-12184 poate pr\u0103bu\u0219i \u00eentregul pool PHP-FPM atunci c\u00e2nd o conexiune HTTPS ini\u021biat\u0103 din aplica\u021bia ta PHP nu trece validarea TLS. Nu este nevoie de un exploit scris special pentru a declan\u0219a problema. CVE-2026-14355 corupe heap-ul managerului de memorie Zend atunci c\u00e2nd aplica\u021bia cripteaz\u0103 date folosind un cifru AES-WRAP-PAD, deoarece PHP dimensioneaz\u0103 gre\u0219it bufferul de ie\u0219ire \u0219i nu ia \u00een calcul padding-ul definit \u00een RFC 5649. Niciunul dintre buletine nu men\u021bioneaz\u0103 exploatare confirmat\u0103 \u00een produc\u021bie, deci vorbim despre o situa\u021bie de tip \u201eaplic\u0103 patch-ul acum\u201d, nu despre un 0-day exploatat activ. Totu\u0219i, condi\u021bia care declan\u0219eaz\u0103 CVE-2026-12184 este suficient de comun\u0103 \u00een trafic real \u00eenc\u00e2t am\u00e2narea actualiz\u0103rii \u00eenseamn\u0103 risc concret.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">Ce se \u00eent\u00e2mpl\u0103 de fapt \u00een CVE-2026-12184<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">Wrapperul HTTP din PHP deschide conexiuni HTTPS de fiecare dat\u0103 c\u00e2nd codul t\u0103u apeleaz\u0103 <code>file_get_contents()<\/code>, <code>fopen()<\/code> sau <code>stream_context_create()<\/code> c\u0103tre un URL <code>https:\/\/<\/code>. Acela\u0219i mecanism poate fi folosit \u0219i de biblioteci client HTTP construite peste stream-urile PHP. Intern, func\u021bia <code>php_stream_url_wrap_http_ex<\/code> apeleaz\u0103 <code>php_stream_xport_crypto_setup<\/code> \u0219i <code>php_stream_xport_crypto_enable<\/code> pentru a negocia conexiunea TLS cu serverul remote.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">C\u00e2nd negocierea TLS e\u0219ueaz\u0103, de exemplu pentru c\u0103 serverul remote prezint\u0103 un certificat expirat sau un certificat emis pentru alt hostname, PHP \u00eenchide stream-ul de dedesubt \u0219i \u00eel reseteaz\u0103 la <code>NULL<\/code>. Problema apare imediat dup\u0103, \u00een codul care cur\u0103\u021b\u0103 peer name-ul: acea rutin\u0103 nu verific\u0103 dac\u0103 stream-ul mai exist\u0103 \u0219i \u00eencearc\u0103 s\u0103 reseteze peer name-ul pe un stream deja distrus.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Pe scurt, CVE-2026-12184 poate pr\u0103bu\u0219i PHP-FPM atunci c\u00e2nd o cerere HTTPS f\u0103cut\u0103 de aplica\u021bia ta e\u0219ueaz\u0103 la validarea TLS. Atacatorul nu trebuie s\u0103 trimit\u0103 direct o cerere mali\u021bioas\u0103 c\u0103tre PHP ca s\u0103 declan\u0219eze comportamentul.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">De ce poate fi declan\u0219at\u0103 de la distan\u021b\u0103 f\u0103r\u0103 exploit personalizat<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">Echipa de securitate PHP noteaz\u0103 c\u0103 problema a fost demonstrat\u0103 f\u0103r\u0103 cod special construit, folosind doar un server remote la care handshake-ul TLS e\u0219ueaz\u0103 \u00een mod normal. Orice endpoint HTTPS apelat de aplica\u021bia ta poate deveni un declan\u0219ator \u00een momentul \u00een care certificatul expir\u0103, este configurat gre\u0219it sau este \u00eenlocuit cu unul care nu corespunde hostname-ului la care se conecteaz\u0103 aplica\u021bia. Cum aceast\u0103 cale de cod \u00eenchide stream-ul, iar rutina de cur\u0103\u021bare ajunge apoi s\u0103 dereferen\u021bieze acel stream, pr\u0103bu\u0219irea poate dobor\u00ee workerul PHP-FPM \u0219i, conform buletinului, \u00eentregul pool, nu doar cererea individual\u0103 care a e\u0219uat.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Vulnerabilitatea are scor CVSS v4 8.2, adic\u0103 High, cu vector de atac prin re\u021bea, f\u0103r\u0103 privilegii necesare \u0219i f\u0103r\u0103 interac\u021biune din partea utilizatorului. Impactul este strict pe disponibilitate. Buletinul nu descrie pierderi de confiden\u021bialitate sau integritate.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">Cel\u0103lalt bug: CVE-2026-14355 \u00een extensia OpenSSL<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-14355 apare \u00eentr-o zon\u0103 mult mai \u00eengust\u0103: familia de cifruri AES key-wrap-with-padding, adic\u0103 algoritmi ale c\u0103ror nume se termin\u0103 \u00een <code>-wrap-pad<\/code>, cum ar fi <code>aes-256-wrap-pad<\/code>, disponibili prin <code>openssl_encrypt()<\/code>. PHP aloc\u0103 bufferul de ie\u0219ire pentru aceast\u0103 opera\u021bie doar pe baza lungimii textului \u00een clar. \u00cens\u0103 key wrap cu padding, conform RFC 5649, rotunje\u0219te textul \u00een clar la urm\u0103torul multiplu de 8 octe\u021bi \u0219i adaug\u0103 un antet de autentificare de 8 octe\u021bi. Lungimea real\u0103 a textului criptat este <code>roundup(len, 8) + 8<\/code>, nu o func\u021bie simpl\u0103 a lungimii de intrare. Bufferul alocat de PHP este prea mic pentru datele scrise efectiv de <code>EVP_EncryptUpdate<\/code> \u0219i <code>EVP_EncryptFinal<\/code> din OpenSSL.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">OpenSSL scrie \u00eentregul rezultat al opera\u021biei de wrap dincolo de limita bufferului subdimensionat, corup\u00e2nd metadatele heap-ului Zend din vecin\u0103tate. Detaliul important pentru depanare este acesta: coruperea nu pr\u0103bu\u0219e\u0219te procesul chiar \u00een momentul \u00een care se produce. Eroarea apare mai t\u00e2rziu, sub forma unui abort de tip <code>zend_mm_heap corrupted<\/code>, atunci c\u00e2nd allocatorul verific\u0103 metadate interne deja deteriorate de o cerere anterioar\u0103. Dac\u0103 \u00eencepi investiga\u021bia exact din punctul indicat de log-ul de crash, exist\u0103 \u0219anse mari s\u0103 cau\u021bi \u00een cererea gre\u0219it\u0103.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Aceast\u0103 vulnerabilitate are scor CVSS v3.1 4.8, adic\u0103 Moderate, cu o complexitate ridicat\u0103 a atacului. Motivul este simplu: un atacator are nevoie ca aplica\u021bia ta s\u0103 foloseasc\u0103 efectiv un cifru AES-WRAP-PAD, iar majoritatea aplica\u021biilor PHP nu ating direct aceast\u0103 zon\u0103. Situa\u021bia este mai probabil\u0103 \u00een biblioteci care gestioneaz\u0103 criptare CMS sau PKCS7, \u00een unele implement\u0103ri JWE (JSON Web Encryption) \u0219i \u00een stack-uri XML\/SAML care folosesc intern AES key wrap.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">Versiuni afectate \u0219i versiuni remediate<\/h2>\n\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Ramur\u0103 PHP<\/th><th>CVE-2026-12184 afectat<\/th><th>CVE-2026-12184 remediat<\/th><th>CVE-2026-14355 afectat<\/th><th>CVE-2026-14355 remediat<\/th><\/tr><\/thead><tbody><tr><td>8.2.x<\/td><td>Nu apare ca afectat<\/td><td>n\/a<\/td><td>&lt; 8.2.32<\/td><td>8.2.32<\/td><\/tr><tr><td>8.3.x<\/td><td>&lt; 8.3.32<\/td><td>8.3.32<\/td><td>&lt; 8.3.32<\/td><td>8.3.32<\/td><\/tr><tr><td>8.4.x<\/td><td>&lt; 8.4.21<\/td><td>8.4.21<\/td><td>&lt; 8.4.23<\/td><td>8.4.23<\/td><\/tr><tr><td>8.5.x<\/td><td>&lt; 8.5.6<\/td><td>8.5.6<\/td><td>&lt; 8.5.8<\/td><td>8.5.8<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n\n<p class=\"wp-block-paragraph\">Observ\u0103 c\u0103 pentru ramura PHP 8.3.x acela\u0219i build, 8.3.32, \u00eenchide ambele probleme. Pentru 8.4.x \u0219i 8.5.x, \u00eens\u0103, versiunile remediate difer\u0103 de la un CVE la altul. Verific\u0103 s\u0103 fii pe cea mai nou\u0103 versiune necesar\u0103 pentru ramura ta, nu doar pe prima versiune care remediaz\u0103 una dintre vulnerabilit\u0103\u021bi.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">Cum verifici dac\u0103 mediul t\u0103u este expus<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">\u00cencepe cu versiunea instalat\u0103:<\/p>\n\n\n\n\n<pre class=\"wp-block-code\"><code>php -v<\/code><\/pre>\n\n\n\n\n\n<p class=\"wp-block-paragraph\">Compar\u0103 rezultatul cu tabelul de mai sus, \u00een func\u021bie de ramura PHP pe care o folose\u0219ti. Dac\u0103 versiunea instalat\u0103 este sub ambele praguri de remediere, e\u0219ti expus la ambele probleme. Dac\u0103 este sub un singur prag, e\u0219ti expus doar la vulnerabilitatea corespunz\u0103toare.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 PHP-FPM se pr\u0103bu\u0219ea deja \u00eenainte s\u0103 verifici versiunea, separ\u0103 acest mod de e\u0219ec de un simplu OOM kill. O pr\u0103bu\u0219ire cauzat\u0103 de CVE-2026-12184 ar trebui s\u0103 apar\u0103 \u00een log-ul masterului PHP-FPM ca un worker terminat cu semnalul 11, adic\u0103 SIGSEGV, corelat cu un apel HTTPS ini\u021biat de aplica\u021bie. Un OOM kill apare, de regul\u0103, ca semnal 9, adic\u0103 SIGKILL, trimis de kernel, nu ca o eroare intern\u0103 PHP:<\/p>\n\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u php8.3-fpm --since \"24 hours ago\" | grep -i \"sig\\|core dump\"\ngrep -i \"signal 11\\|SIGSEGV\" \/var\/log\/php8.3-fpm.log 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n\n\n<p class=\"wp-block-paragraph\">Intr\u0103rile repetate de SIGSEGV ap\u0103rute \u00een acela\u0219i interval cu proces\u0103ri de webhook-uri, apeluri API remote sau prelu\u0103ri programate de feed-uri indic\u0103 spre CVE-2026-12184. Un tipar de SIGKILL indic\u0103 mai degrab\u0103 limite de memorie \u0219i trebuie investigat separat ca problem\u0103 de tuning.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Pentru bug-ul din OpenSSL, verific\u0103 dac\u0103 baza ta de cod folose\u0219te vreun cifru wrap-pad. Expunerea exist\u0103 doar dac\u0103 acest tip de algoritm este apelat efectiv:<\/p>\n\n\n\n\n<pre class=\"wp-block-code\"><code>grep -rniE \"wrap-pad|WRAP_PAD\" \/var\/www --include=*.php<\/code><\/pre>\n\n\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 nu prime\u0219ti rezultate, CVE-2026-14355 probabil nu este un risc practic \u00een codul propriu al aplica\u021biei. Totu\u0219i, o bibliotec\u0103 ter\u021b\u0103 sau o dependen\u021b\u0103 Composer ar putea apela indirect acel cifru, deci merit\u0103 verificat \u0219i directorul <code>vendor\/<\/code> dac\u0103 prima c\u0103utare nu g\u0103se\u0219te nimic.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 o pr\u0103bu\u0219ire PHP-FPM apare pentru vizitatori ca pagin\u0103 goal\u0103 sau eroare de gateway, nu ca eroare PHP clar\u0103, ghidul nostru despre <a href=\"https:\/\/www.serverspan.ro\/blog\/site-ul-este-down-verifici-mai-intai-dns-ul-sau-hosting-ul-un-workflow-practic-de-depanare\/\">depanarea unui site c\u0103zut, DNS sau hosting<\/a> te ajut\u0103 s\u0103 urm\u0103re\u0219ti problema p\u00e2n\u0103 la stratul corect, chiar dac\u0103 nu trateaz\u0103 direct acest CVE.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">Aplic\u0103 patch-ul acum: comenzi de actualizare<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">Pe sisteme Debian sau Ubuntu care folosesc PPA-ul Ond\u0159ej Sur\u00fd:<\/p>\n\n\n\n\n<pre class=\"wp-block-code\"><code>apt update\napt list --upgradable | grep -i php\napt install --only-upgrade php8.3-fpm php8.3-common php8.3-opcache\nphp-fpm8.3 -t\nsystemctl reload php8.3-fpm<\/code><\/pre>\n\n\n\n\n\n<p class=\"wp-block-paragraph\">Ruleaz\u0103 <code>php-fpm8.3 -t<\/code> \u00eenainte de reload. Comanda valideaz\u0103 configura\u021bia pool-ului f\u0103r\u0103 s\u0103 ating\u0103 workerii activi. O eroare prins\u0103 aici se repar\u0103 imediat; o eroare prins\u0103 dup\u0103 reload \u00ee\u021bi poate l\u0103sa pool-ul indisponibil. Folose\u0219te <code>reload<\/code> \u00een loc de <code>restart<\/code> acolo unde versiunea ta suport\u0103 acest lucru: reload las\u0103 cererile \u00een curs s\u0103 se termine pe workerii vechi \u0219i porne\u0219te workeri noi cu binarul actualizat, \u00een timp ce restart \u00eentrerupe conexiunile imediat.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Pe sisteme din familia RHEL care folosesc repository-ul Remi:<\/p>\n\n\n\n\n<pre class=\"wp-block-code\"><code>dnf update --enablerepo=remi-php84 php php-fpm php-openssl\nphp-fpm84 -t\nsystemctl restart php84-php-fpm<\/code><\/pre>\n\n\n\n\n\n<p class=\"wp-block-paragraph\">Confirm\u0103 c\u0103 patch-ul a ajuns pe procesul care deserve\u0219te efectiv traficul, nu doar pe binarul CLI. Pe majoritatea distribu\u021biilor, PHP CLI \u0219i PHP-FPM sunt pachete separate:<\/p>\n\n\n\n\n<pre class=\"wp-block-code\"><code>php -v\nsystemctl status php8.3-fpm --no-pager<\/code><\/pre>\n\n\n\n\n\n<p class=\"wp-block-paragraph\">Un rezultat bun arat\u0103 versiunea remediat\u0103 din tabelul de mai sus \u0219i un status <code>active (running)<\/code>, f\u0103r\u0103 restarturi nea\u0219teptate \u00een log \u00een afara celui declan\u0219at de actualizare. Dac\u0103 pachetul remediat nu a ajuns \u00eenc\u0103 \u00een repository-ul distribu\u021biei tale, aceasta este o problem\u0103 real\u0103. Urm\u0103re\u0219te repository-ul \u0219i aplic\u0103 actualizarea imediat ce devine disponibil\u0103, nu la urm\u0103torul ciclu comod de mentenan\u021b\u0103.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 administrezi versiunile PHP printr-un panou de control, nu ocoli mecanismul panoului. MultiPHP Manager din cPanel \u0219i PHP Selector din DirectAdmin controleaz\u0103 ce handler PHP-FPM deserve\u0219te fiecare domeniu. O actualizare brut\u0103 prin <code>apt<\/code> sau <code>dnf<\/code>, f\u0103cut\u0103 \u00een afara acestei map\u0103ri, poate l\u0103sa unele domenii pe un handler nepotrivit sau neactualizat.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">Este, de fapt, un 0-day?<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">Un 0-day \u00eenseamn\u0103 c\u0103 atacatorii exploateaz\u0103 o vulnerabilitate \u00eenainte s\u0103 existe un patch disponibil. Nu aceasta este situa\u021bia aici. Echipa de securitate PHP a publicat versiuni remediate odat\u0103 cu buletinele care au dezv\u0103luit cele dou\u0103 bug-uri. Pentru administratorii care actualizeaz\u0103 prompt, nu exist\u0103 o fereastr\u0103 inevitabil\u0103 f\u0103r\u0103 patch. Niciunul dintre buletine nu men\u021bioneaz\u0103 dovezi de exploatare \u00eenainte de publicarea remedierilor.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Ceea ce face CVE-2026-12184 urgent\u0103 nu este statutul de 0-day, ci pragul foarte jos de declan\u0219are. Orice e\u0219ec TLS pe o conexiune ini\u021biat\u0103 de aplica\u021bia ta PHP, inclusiv un simplu certificat expirat la un furnizor integrat, poate duce acum la c\u0103derea \u00eentregului pool PHP-FPM. Nu este nevoie ca atacatorul s\u0103-\u021bi compromit\u0103 infrastructura. Este suficient s\u0103 poat\u0103 influen\u021ba un endpoint TLS pe care aplica\u021bia ta \u00eel apeleaz\u0103 sau, mai banal, ca acel endpoint s\u0103 fie configurat prost.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">Regul\u0103 de decizie: patch imediat sau mentenan\u021b\u0103 programat\u0103<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">Aplic\u0103 patch-ul pentru CVE-2026-12184 f\u0103r\u0103 am\u00e2nare dac\u0103 aplica\u021bia ta face apeluri HTTPS c\u0103tre endpoint-uri pe care nu le controlezi complet: webhook-uri ter\u021be, sincroniz\u0103ri API cu parteneri, feed-uri sau imagini preluate de la distan\u021b\u0103, callback-uri de la procesatori de pl\u0103\u021bi. Un singur certificat expirat la un furnizor poate deveni un declan\u0219ator pentru oprirea complet\u0103 a pool-ului PHP-FPM, nu doar pentru e\u0219ecul unei cereri izolate.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-14355 poate, \u00een general, s\u0103 a\u0219tepte urm\u0103toarea fereastr\u0103 de mentenan\u021b\u0103 dac\u0103 nu g\u0103se\u0219ti utiliz\u0103ri de cifruri wrap-pad \u00een cod. Exploatarea presupune ca stack-ul t\u0103u s\u0103 aleag\u0103 activ acel algoritm, lucru pe care majoritatea aplica\u021biilor PHP nu \u00eel fac niciodat\u0103. Totu\u0219i, aplic\u0103 patch-ul \u00een aceea\u0219i rund\u0103 de actualiz\u0103ri. Pe ramura 8.3.x aceea\u0219i versiune remediaz\u0103 ambele bug-uri, iar pe 8.4.x \u0219i 8.5.x trebuie doar s\u0103 te asiguri c\u0103 ajungi la versiunea cea mai nou\u0103 necesar\u0103 pentru ramura ta.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 rulezi o aplica\u021bie g\u0103zduit\u0103 de tine pe un VPS \u0219i vrei o privire mai ampl\u0103 asupra problemelor de tuning PHP-FPM care nu \u021bin direct de aceste dou\u0103 CVE-uri, vezi ghidul nostru despre <a href=\"https:\/\/www.serverspan.ro\/blog\/nextcloud-30-pe-vps-da-timeout-repara-php-fpm-redis-cron-mariadb-si-reverse-proxy-ul-ca-instanta-sa-nu-moara-dupa-3-luni\/\">repararea PHP-FPM, bloc\u0103rilor Redis \u0219i gre\u0219elilor de reverse proxy pe o instan\u021b\u0103 Nextcloud pe VPS<\/a>.<\/p>\n\n\n\n\n<h2 class=\"wp-block-heading\">C\u00e2nd are sens s\u0103 ceri ajutor administrat<\/h2>\n\n\n\n\n<p class=\"wp-block-paragraph\">Aplicarea \u00een siguran\u021b\u0103 a unui patch PHP-FPM \u00eenseamn\u0103 s\u0103 testezi configura\u021bia \u00eenainte de reload, s\u0103 urm\u0103re\u0219ti logurile \u00een timpul actualiz\u0103rii \u0219i s\u0103 confirmi c\u0103 versiunea remediat\u0103 ruleaz\u0103 chiar pe procesul care serve\u0219te traficul. Dac\u0103 preferi ca aceste lucruri s\u0103 fie monitorizate \u0219i aplicate de o echip\u0103 de hosting, nu f\u0103cute pe fug\u0103 c\u00e2nd ceva deja pic\u0103, serviciul de <a href=\"https:\/\/www.serverspan.ro\/linux-administration\">administrare Linux ServerSpan<\/a> acoper\u0103 actualiz\u0103ri de versiuni PHP, configurarea pool-urilor PHP-FPM \u0219i revizuirea logurilor ca parte a administr\u0103rii continue a serverului. Serverele livrate prin <a href=\"https:\/\/www.serverspan.ro\/virtual-servers\">hostingul VPS ServerSpan<\/a> vin cu acces root complet, deci po\u021bi aplica singur comenzile de mai sus imediat ce pachetul remediat ajunge \u00een repository-ul distribu\u021biei tale.<\/p>\n\n\n\n\n<p class=\"wp-block-paragraph\">Nu este primul caz din acest an \u00een care un serviciu activat implicit sau o problem\u0103 de runtime se transform\u0103 \u00eentr-un avertisment de patch chiar \u00een ziua public\u0103rii. Vezi \u0219i analiza noastr\u0103 despre <a href=\"https:\/\/www.serverspan.ro\/blog\/cups-rce-pe-vps-linux-cve-2026-34980-se-inlantuie-pana-la-root-verifica-daca-esti-expus-chiar-acum\/\">lan\u021bul CUPS RCE p\u00e2n\u0103 la root<\/a>, un alt exemplu \u00een care o setare implicit\u0103 trecut\u0103 cu vederea pe un VPS Linux a devenit o cale complet\u0103 de compromitere.<\/p>\n\n","protected":false},"excerpt":{"rendered":"<p>Dou\u0103 buletine de securitate PHP publicate pe 2 iulie 2026 remediaz\u0103 o vulnerabilitate denial-of-service cu severitate ridicat\u0103 \u0219i un bug de corupere a memoriei cu severitate moderat\u0103. CVE-2026-12184 poate pr\u0103bu\u0219i \u00eentregul pool PHP-FPM atunci c\u00e2nd o conexiune HTTPS ini\u021biat\u0103 din aplica\u021bia ta PHP nu trece validarea TLS. Nu este nevoie de un exploit scris special [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2961,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[16831,16838,16832,16845,16839,16843,16846,16837,16800,16841,16853,16850,16855,16834,16835,16836,16854,16847,16849,16840,16811,16822,16844,16848,16842,16830,16851,16818,16852,16833],"class_list":["post-2963","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hosting-news","tag-actualizare-securitate-php-8-3-32","tag-actualizare-securitate-php-8-4-21","tag-actualizare-securitate-php-8-5-6","tag-aviz-securitate-php-iulie-2026","tag-bug-openssl_encrypt-aes-wrap-pad","tag-corupere-memorie-php-openssl","tag-cum-aplici-patch-pe-php-fpm","tag-cve-2026-12184-patch-php-fpm","tag-cve-2026-14355","tag-eroare-zend_mm_heap-corrupted","tag-este-acest-cve-un-0-day","tag-overflow-aes-key-wrap-padding","tag-patch-hosting-php-administrat","tag-patch-php-8-4-23","tag-patch-php-8-5-8","tag-patch-securitate-php-8-2-32","tag-php-cerere-https-iesita-crash","tag-php-certificat-expirat-dos","tag-php-denial-of-service-la-distanta","tag-php-dos-esec-handshake-tls","tag-php-stream-wrapper-null-pointer","tag-php-fpm-reload-vs-restart","tag-php-fpm-segfault-certificat-tls","tag-ppa-ondrej-sury-actualizare-php","tag-prabusire-pool-php-fpm","tag-reparare-crash-php-fpm","tag-repository-remi-upgrade-php","tag-rfc-5649-key-wrap-padding","tag-verifica-versiune-php-vulnerabila","tag-vulnerabilitate-php_stream_url_wrap_http_ex"],"_links":{"self":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2963"}],"version-history":[{"count":2,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2963\/revisions"}],"predecessor-version":[{"id":2966,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2963\/revisions\/2966"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=\/wp\/v2\/media\/2961"}],"wp:attachment":[{"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.serverspan.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}