CVE-2026-44167: Phpseclib

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fixed in 1.0.29, 2.0.54, and 3.0.52.

Affected products

• Phpseclib Phpseclib: from 3.0.0, before 3.0.52 (fixed in 3.0.52); from 2.0.0, before 2.0.54 (fixed in 2.0.54); from 0.1.1, before 1.0.29 (fixed in 1.0.29)

Published 2026-05-12. Last modified 2026-06-17.