CVE-2026-40194

phpseclib is a PHP secure communications library. Starting in 0.1.1 and prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC against the locally computed HMAC. != on equal-length binary strings in PHP uses memcmp(), which short-circuits on the first differing byte. This is a real variable-time comparison (CWE-208), proven by scaling benchmarks. This vulnerability is fixed in 3.0.51, 2.0.53, and 1.0.28.

• CWE-208

• https://github.com/phpseclib/phpseclib/commit/ffe48b6b1b1af6963327f0a5330e3aa004a194acPatch
• https://github.com/phpseclib/phpseclib/releases/tag/1.0.28Release Notes
• https://github.com/phpseclib/phpseclib/releases/tag/2.0.53Release Notes
• https://github.com/phpseclib/phpseclib/releases/tag/3.0.51Release Notes
• https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qxVendor Advisory
• https://github.com/phpseclib/phpseclib/security/advisories/GHSA-r854-jrxh-36qxVendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40189goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.8
• CVE-2026-4019The Complianz – GDPR/CCPA Cookie Consent plugin for WordPres…5.3
• CVE-2026-40190LangSmith Client SDKs provide SDK's for interacting with the…9.8
• CVE-2026-40191ClearanceKit intercepts file-system access events on macOS a…6.8
• CVE-2026-40192Pillow is a Python imaging library. Versions 10.3.0 through …7.5
• CVE-2026-40193maddy is a composable, all-in-one mail server. Versions prio…8.2
• CVE-2026-40195Incus is a system container and virtual machine manager. In …6.5
• CVE-2026-40196HomeBox is a home inventory and organization system. Version…8.1
• CVE-2026-40197Incus is a system container and virtual machine manager. In …6.5
• CVE-2026-40198Net::CIDR::Lite versions before 0.23 for Perl does not valid…7.5
• CVE-2026-40199Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv…6.5
• CVE-2026-4020The Gravity SMTP plugin for WordPress is vulnerable to Sensi…7.5