PHP Patches Remote DoS Flaw CVE-2026-12184 and an OpenSSL Memory Corruption Bug

PHP security advisory: two vulnerabilities were fixed — a remote DoS via TLS cleanup (CVE-2026-12184, CVSS 8.2) that can crash PHP-FPM workers, and an OpenSSL AES-WRAP-PAD heap overflow (CVE-2026-14355, CVSS 5.6) that can corrupt heap metadata; patches are available for supported 8.2–8.5 branches and administrators should update immediately. No evidence of active exploitation has been reported.