In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before ...

password_verify can erroneously return true, opening ATO risk

Уязвимость функции password_verify() интерпретатора языка программирования PHP, позволяющая нарушителю обойти процесс аутентификации и получить несанкционированный доступ к веб-приложению

Security update for php8

Security update for php74

Security update for php7

Уязвимость php

Уязвимость php

Уязвимость php

Security update for php7

ELSA-2024-10951: php:8.2 security update (MODERATE)

ELSA-2024-10950: php:8.1 security update (MODERATE)

ELSA-2024-10949: php:8.2 security update (MODERATE)

ELSA-2025-7315: php security update (MODERATE)

ELSA-2024-10952: php:7.4 security update (MODERATE)