CVE-2026-14355: Debian 12 PHP 8.2 Buffer Overflow — Detection and Remediation Guide

A critical memory corruption vulnerability has been identified in the PHP 8.2 package within the Debian 12 (Bookworm) distribution. Designated as CVE-2026-14355 and tracked under Debian Security Advisory DLA-4669-1, this flaw stems from a buffer overflow in the implementation of AES Key Wrap with Padding within the PHP openssl extension.

For defenders, this is a high-priority event. Successful exploitation of this buffer overflow can crash the PHP interpreter or, more critically, allow an attacker to execute arbitrary code. Given the ubiquity of PHP in web application stacks and the direct exposure of the openssl extension to unencrypted input often handled by web applications, the attack surface is significant. Immediate patching is required to maintain the integrity of Debian 12 hosts.

Technical Analysis

Affected Products and Versions:

• OS: Debian 12 (Bookworm)
• Software: PHP 8.2
• Component: openssl extension (specifically the AES Key Wrap with Padding implementation)

Vulnerability Details:

• CVE ID: CVE-2026-14355
• Weakness: Buffer Overflow (CWE-120)

The vulnerability resides in how the PHP openssl extension handles AES Key Wrap with Padding operations. When processing specific inputs, the application fails to properly validate buffer boundaries, leading to an overflow condition.

From an attack chain perspective, a remote attacker does not need local access. If a web application utilizes the vulnerable openssl_encrypt or openssl_decrypt functions with AES Key Wrap algorithms and processes attacker-supplied ciphertext (e.g., via session tokens, API parameters, or encrypted cookies), the attacker can trigger the overflow. This results in memory corruption, which typically leads to a Denial of Service (DoS) via segmentation fault, but in specific heap layouts, can be leveraged for Remote Code Execution (RCE) to bypass security controls.

Exploitation Status: As of this advisory publication, CVE-2026-14355 is a patched vulnerability. While specific active exploitation campaigns in the wild have not been widely reported at this moment, the nature of the flaw (memory corruption in a widely used crypto library) makes it a prime target for automated scanning and weaponization shortly after patch release. The theoretical severity is high.

Detection & Response

SIGMA Rules

The following Sigma rules focus on detecting the aftermath of exploitation—specifically the crash of the PHP-FPM service (common in buffer overflows) and the potential execution of a shell via the web server user (RCE).

---
title: Potential PHP Exploitation - Service Segfault
id: 8a4b3c2d-1e9f-4a5b-8c2d-1e9f4a5b8c2d
status: experimental
description: Detects segmentation faults or service crashes in PHP-FPM processes which may indicate successful memory corruption exploitation attempts.
references:
  - https://security-tracker.debian.org/tracker/CVE-2026-14355
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.impact
  - attack.t1499
logsource:
  product: linux
  service: systemd
detection:
  selection:
    message|contains:
      - 'php-fpm'
      - 'php8.2'
    message|contains:
      - 'segfault'
      - 'core dump'
      - 'killed'
  condition: selection
falsepositives:
  - Legitimate application bugs causing crashes
  - OOM kills during high load
level: high
---
title: Web Server Spawning Shell - Potential RCE
id: 9b5c4d3e-2f0a-5b6c-9d3e-2f0a5b6c9d3e
status: experimental
description: Detects the web server user (www-data) spawning a shell, often a sign of successful Remote Code Execution via a web vulnerability like CVE-2026-14355.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    User|contains:
      - 'www-data'
      - 'apache'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  condition: selection
falsepositives:
  - Administrators troubleshooting via sudo -u www-data
  - Legitimate system administration scripts
level: critical

KQL (Microsoft Sentinel / Defender)

This KQL query hunts for Linux Syslog data (ingested via the Syslog connector or CEF) indicating PHP crashes or abnormal process termination.

Syslog
| where SyslogMessage has_any ("php-fpm", "php8.2") 
| where SyslogMessage has_any ("segfault", "segmentation fault", "core dump", "killed") 
| project TimeGenerated, Computer, SeverityLevel, SyslogMessage, Facility
| summarize count() by Computer, bin(TimeGenerated, 5m)
| where count_ > 2

Velociraptor VQL

Use this Velociraptor artifact to hunt for the installed version of PHP 8.2 and verify if it matches the vulnerable range or if the patch has been applied.

-- Hunt for vulnerable PHP 8.2 versions on Debian 12
SELECT Name, Version, Architecture, InstallTime
FROM linux_apt_packages()
WHERE Name = 'php8.2'
-- Administrators should verify this version against the fixed version in DLA-4669-1

Remediation Script (Bash)

The following script automates the patching process for CVE-2026-14355 on Debian 12 systems by updating the package repository and upgrading the PHP packages to the patched version.

#!/bin/bash
# Remediation script for CVE-2026-14355 (DLA-4669-1)
# Target: Debian 12 (Bookworm) - PHP 8.2

echo "[*] Starting remediation for CVE-2026-14355..."

# Update package lists to ensure we have the latest security metadata
echo "[*] Updating apt cache..."
apt-get update -qq

# Upgrade php8.2 packages to the patched version
# This covers php8.2-cli, php8.2-fpm, php8.2-common, etc.
echo "[*] Installing patched PHP 8.2 packages..."
apt-get install -y --only-upgrade php8.2 php8.2-fpm php8.2-common

# Verify installation status
if [ $? -eq 0 ]; then
    echo "[+] Packages updated successfully."
    echo "[*] Restarting PHP-FPM service to apply changes..."
    systemctl restart php8.2-fpm
    
    # Also restart Apache if mod_php is in use (common scenario)
    if systemctl is-active --quiet apache2; then
        echo "[*] Restarting Apache2..."
        systemctl restart apache2
    fi
    
    echo "[+] Remediation complete. Installed versions:"
    dpkg -l | grep php8.2
else
    echo "[-] Error during package installation. Please check apt logs."
    exit 1
fi

Remediation

To mitigate the risk posed by CVE-2026-14355, administrators of Debian 12 systems must update the php packages to the version provided in DLA-4669-1.

Specific Steps:

1. Verify Version: Check your current PHP version using dpkg -l | grep php8.2.
2. Update Repository: Run apt-get update.
3. Apply Patch: Execute apt-get upgrade or specifically target the package: apt-get install -t bookworm-security php8.2.
4. Restart Services: It is critical to restart the PHP-FPM daemon and the Web Server (Apache/Nginx) to ensure the vulnerable binary is removed from memory.
   • systemctl restart php8.2-fpm
   • systemctl restart apache2 (if applicable)

Vendor Advisory:

• Debian LTS Advisory DLA-4669-1

There are currently no known configuration workarounds that completely mitigate this vulnerability without applying the code patch. Disabling the openssl extension is not viable for most production environments.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub