CVE-2026-32935

phpseclib is a PHP secure communications library. Projects using versions 0.1.1 through 1.0.26, 2.0.0 through 2.0.51, and 3.0.0 through 3.0.49 are vulnerable to a to padding oracle timing attack when using AES in CBC mode. This issue has been fixed in versions 1.0.27, 2.0.52 and 3.0.50.

• CWE-208

• https://github.com/phpseclib/phpseclib/commit/ccc21aef71eb170e9bf819b167e67d1fd9e6e788Patch
• https://github.com/phpseclib/phpseclib/security/advisories/GHSA-94g3-g5v7-q4jgPatch, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3293A weakness has been identified in snowflakedb snowflake-jdbc…5.5
• CVE-2026-32930Chamilo LMS is a learning management system. Prior to 1.11.3…7.1
• CVE-2026-32931Chamilo LMS is a learning management system. Prior to 1.11.3…8.8
• CVE-2026-32932Chamilo LMS is a learning management system. Prior to 1.11.3…6.1
• CVE-2026-32933AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-32934CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32936CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32937free5GC is an open source 5G core network. free5GC CHF prior…6.5
• CVE-2026-32938SiYuan is a personal knowledge management system. In version…6.5
• CVE-2026-32939DataEase is an open source data visualization analysis tool.…8.1
• CVE-2026-3294An authentication logic vulnerability in multiple TP-Link ra…8.8
• CVE-2026-32940SiYuan is a personal knowledge management system. In version…6.1