USN-8769-1: phpseclib vulnerability

Publication date

15 September 2026

Overview

phpseclib could be made to expose sensitive information over the network.


Packages

  • phpseclib - implementations of an arbitrary-precision integer arithmetic library

Details

It was discovered that phpseclib did not perform padding validation in
constant time when using AES in CBC mode. A remote attacker could possibly
use this issue to conduct a padding oracle timing attack and obtain
sensitive information.

It was discovered that phpseclib did not perform padding validation in
constant time when using AES in CBC mode. A remote attacker could possibly
use this issue to conduct a padding oracle timing attack and obtain
sensitive information.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04 LTS resolute php-seclib –  1.0.24-1ubuntu0.1~esm1  
24.04 LTS noble php-seclib –  1.0.23-1ubuntu0.1~esm1  
22.04 LTS jammy php-seclib –  1.0.20-1+deb12u3build0.22.04.1
20.04 LTS focal php-seclib –  1.0.18-2ubuntu0.1~esm2  
18.04 LTS bionic php-seclib –  1.0.9-1ubuntu0.1~esm2  
16.04 LTS xenial php-seclib –  1.0.1-3ubuntu0.1+esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›