PHP Security Update Patches Credential Leakage in HTTP Redirects
PHP has released a security update to fix CVE-2026-91766, a vulnerability that causes sensitive credentials to leak during HTTP redirects.
PHP has issued a security release for CVE-2026-91766, addressing a credential leakage vulnerability that occurs during HTTP redirects.
The flaw involves how the language handles credential forwarding when an HTTP redirect triggers. A similar issue was addressed in the curl library in 2018. However, PHP required further remediation to stop credentials from being inadvertently exposed when a request follows a redirected path.
This update closes a specific path leading to credential exposure in real-world application code. Since this scenario is not limited to edge cases and can manifest in standard development patterns, maintainers prioritized the fix in the current release cycle.
You need to update. Administrators and developers must verify their current PHP versions and apply the update to mitigate exposure and keep components interacting with HTTP client libraries protected against this type of data leakage.