PHP FastCGI flaw truncates IPv6 client checks
CVE-2026-91768 concerns PHP’s FastCGI handling of the allowed_clients setting.
R/PHP (TOP), October 12, 2026
curated by Sönke
The check examines only 96 of the 128 bits in an IPv6 address, leaving part of the address outside the comparison. The available report identifies the defect, but provides no affected versions, exploit status, or remediation details.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.