PHP Internals ([RFC]/[VOTE]) · September 29, 2026 · 1 min readcurated by Sönke
Sjoerd Langkemper has proposed the PHP RFC bcrypt_max_password_length. It would make password_hash() throw ValueError when bcrypt receives input longer than 72 bytes. PHP currently truncates longer input silently, hashing only the first 72 bytes. The change targets severe security vulnerabilities, especially in applications that hash data beyond a user’s password.
Illustration: The Dev Dispatch
Sjoerd Langkemper has drafted the PHP RFC bcrypt_max_password_length. It proposes that password_hash() throw ValueError when bcrypt receives a password longer than 72 bytes.
PHP currently truncates longer input without warning and hashes only the first 72 bytes. The proposal aims to prevent severe security vulnerabilities caused by this behavior. It would primarily affect applications that pass data other than the user’s password to password_hash().
PHP internals has a backward-compatible answer to bcrypt’s 72-byte limit: Sjoerd Langkemper proposes the opt-in PASSWORD_BCRYPT_SHA256 algorithm, base…
October 21 gave us a Laravel token guard bypass and two PHP flaws rated CVSS 9.2 on the same afternoon. Eight days on, the teams that shipped fast did…
New reporting on php2shell shows the operational impact: organizations in several countries took government and institutional sites offline after BSI …
A Hacker News post reports an expected PHP announcement on 22 October 2026 at 18:00 CEST covering two remote-code-execution vulnerabilities with CVSS …
Comments
No comments yet — be the first.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.