Upgrading phpseclib/phpseclib 0.3 to 1
Breaking0.3.10 → 1.0.30Breaking2Security8Platform1Deprecated4New37Changed9Fixed59Other86
SecurityModerate · CVSS 5.8Adds X509 setURLFetchCallback() method (CVE-2026-55599).GHSA-m557-wrgg-6rp4 · CVE-2026-55599 ↗
BreakingUpgrade verdict
2 breaking changes and a platform requirement change and 8 security fixes.
In plain terms
- X509: fix 7.2 error when extensions were removed and new ones added.
- Fix for PHP 8.5 BC breaking changes on 32-bit machines.
- X509: use anonymous functions in PHP >= 5.3.0.
- Adds a way to control how X509 certificate URLs are fetched, addressing a security issue.
Must act Top 5 of 15 that need code or config changes
What you must change
Breaking2
X509: fix 7.2 error when extensions were removed and new ones added.
Fix for PHP 8.5 BC breaking changes on 32-bit machines.
Security8
Adds X509 setURLFetchCallback() method (CVE-2026-55599).
setURLFetchCallback()Moderate · CVSS 5.8Enforces more stringent OID length limits in ASN1 parsing (CVE-2026-44167).
ASN1High · CVSS 7.5SSH2: use constant time string comparison in get_binary_packet (CVE-2026-40194).
Low · CVSS 3.7Make unpadding in CBC mode constant time (CVE-2026-32935).
HighBigInteger: put guardrails on isPrime and randomPrime (CVE-2024-27354).
High · CVSS 7.5ASN1: limit OID length (CVE-2024-27355).
High · CVSS 7.5Name confusion in x509 Subject Alternative Name fields
High · CVSS 7.5cleanup RSA PKCS#1 v1.5 signature verification (CVE-2021-30130).
Platform1
X509: use anonymous functions in PHP >= 5.3.0.
Deprecations to plan for
Deprecated4
more PHP 8.5 deprecations.
more PHP 8.5 deprecations.
OpenSSL 3.0.1+ deprecated some algorithms.
Random: suppress possible E_DEPRECATED errors.
API changes
Generated by DepDelta from published PHP source. Not mixed with prose notes.
- removed:
method Crypt_AES.setKey($key) - removed:
method Crypt_Base._generateXor(&$iv, $length) - removed:
method Crypt_Base._stringShift(&$string, $index = …) - removed:
method Crypt_Blowfish.setKey($key) - removed:
method Crypt_RC2.Crypt_RC2($mode = …) - removed:
method Crypt_RC4.setKey($key) - removed:
method Crypt_Rijndael._setupEngine() - removed:
method Crypt_Rijndael._setupMcrypt() - removed:
method Crypt_Rijndael.setKey($key) - removed:
method Crypt_Twofish.setKey($key) - removed:
method File_ASN1._decodeTime($content, $tag) - removed:
method Net_SFTP.login($username) - removed:
method Net_SFTP_Stream.Net_SFTP_Stream() - removed:
property Crypt_Base.password_key_size - removed:
property Crypt_Blowfish.password_key_size - removed:
property Crypt_DES.key - removed:
property Crypt_DES.key_size_max - removed:
property Crypt_DES.password_key_size - removed:
property Crypt_RC2.password_key_size - removed:
property Crypt_RC4.password_key_size - removed:
property Crypt_Rijndael.dt0 - removed:
property Crypt_Rijndael.dt1 - removed:
property Crypt_Rijndael.dt2 - removed:
property Crypt_Rijndael.dt3 - removed:
property Crypt_Rijndael.explicit_key_length - removed:
property Crypt_Rijndael.isbox - removed:
property Crypt_Rijndael.key_size - removed:
property Crypt_Rijndael.password_key_size - removed:
property Crypt_Rijndael.sbox - removed:
property Crypt_Rijndael.t0 - removed:
property Crypt_Rijndael.t1 - removed:
property Crypt_Rijndael.t2 - removed:
property Crypt_Rijndael.t3 - removed:
property Crypt_TripleDES.key_size_max - removed:
property Crypt_TripleDES.password_key_size - removed:
property File_ANSI.background - removed:
property File_ANSI.blink - removed:
property File_ANSI.bold - removed:
property File_ANSI.color - removed:
property File_ANSI.foreground - removed:
property File_ANSI.reverse - removed:
property File_ANSI.underline - removed:
property Math_BigInteger.generator - removed:
property Net_SFTP.request_id - removed:
property Net_SSH1.protocol_flag_log - removed:
property Net_SSH2.connectionTimeout - changed:
method File_ASN1._decode_ber($encoded, $start = …) → method File_ASN1._decode_ber($encoded, $start = …, $encoded_pos = …) - changed:
method File_X509.loadCRL($crl) → method File_X509.loadCRL($crl, $mode = …) - changed:
method File_X509.loadCSR($csr) → method File_X509.loadCSR($csr, $mode = …) - changed:
method File_X509.loadX509($cert) → method File_X509.loadX509($cert, $mode = …) - changed:
method Net_SFTP._get_sftp_packet() → method Net_SFTP._get_sftp_packet($request_id = …) - changed:
method Net_SFTP._mkdir_helper($dir, $attr) → method Net_SFTP._mkdir_helper($dir, $mode) - changed:
method Net_SFTP._send_sftp_packet($type, $data) → method Net_SFTP._send_sftp_packet($type, $data, $request_id = …) - changed:
method Net_SFTP.get($remote_file, $local_file = …, $offset = …, $length = …) → method Net_SFTP.get($remote_file, $local_file = …, $offset = …, $length = …, $progressCallback = …) - changed:
method Net_SFTP.put($remote_file, $data, $mode = …, $start = …, $local_start = …) → method Net_SFTP.put($remote_file, $data, $mode = …, $start = …, $local_start = …, $progressCallback = …) - changed:
method Net_SSH2._filter($payload) → method Net_SSH2._filter($payload, $skip_channel_filter) - changed:
method Net_SSH2._get_binary_packet() → method Net_SSH2._get_binary_packet($skip_channel_filter = …) - changed:
method Net_SSH2._key_exchange($kexinit_payload_server) → method Net_SSH2._key_exchange($kexinit_payload_server = …) - changed:
method System_SSH_Agent.System_SSH_Agent() → method System_SSH_Agent.System_SSH_Agent($address = …) - added:
constructor Crypt_Base($mode = …) - added:
constructor Crypt_Blowfish($mode = …) - added:
constructor Crypt_Hash($hash = …) - added:
constructor Crypt_RC4() - added:
constructor Crypt_RSA() - added:
constructor Crypt_TripleDES($mode = …) - added:
constructor Crypt_Twofish($mode = …) - added:
constructor File_ANSI() - added:
constructor File_ASN1() - added:
constructor File_ASN1_Element($encoded) - added:
constructor File_X509() - added:
constructor Math_BigInteger($x = …, $base = …) - added:
constructor Net_SCP($ssh) - added:
constructor Net_SFTP($host, $port = …, $timeout = …) - added:
constructor Net_SFTP_Stream() - added:
constructor Net_SSH1($host, $port = …, $timeout = …, $cipher = …) - added:
constructor Net_SSH2($host, $port = …, $timeout = …) - added:
constructor System_SSH_Agent($address = …) - added:
constructor System_SSH_Agent_Identity($fsock) - added:
function phpseclib_safe_serialize(&$arr) - added:
method Crypt_Base._hashInlineCryptFunction($bytes) - added:
method Crypt_Base._increment_str(&$var) - added:
method Crypt_Base._openssl_ctr_process($plaintext, &$encryptIV, &$buffer) - added:
method Crypt_Base._openssl_ofb_process($plaintext, &$encryptIV, &$buffer) - added:
method Crypt_Base._openssl_translate_mode() - added:
method Crypt_Base._setEngine() - added:
method Crypt_Base._string_pop(&$string, $index = …) - added:
method Crypt_Base._string_shift(&$string, $index = …) - added:
method Crypt_Base.continuousBufferEnabled() - added:
method Crypt_Base.do_nothing() - added:
method Crypt_Base.getBlockLength() - added:
method Crypt_Base.getEngine() - added:
method Crypt_Base.getKeyLength() - added:
method Crypt_Base.isValidEngine($engine) - added:
method Crypt_Base.safe_intval($x) - added:
method Crypt_Base.safe_intval_inline() - added:
method Crypt_Base.setKeyLength($length) - added:
method Crypt_Base.setPreferredEngine($engine) - added:
method Crypt_Blowfish._bcrypt_hash($sha2pass, $sha2salt) - added:
method Crypt_Blowfish._encryptBlockHelperFast($x0, $x1, $sbox0, $sbox1, $sbox2, $sbox3, $p) - added:
method Crypt_Blowfish._encryptBlockHelperSlow($x0, $x1, $sbox0, $sbox1, $sbox2, $sbox3, $p) - added:
method Crypt_Blowfish._expand0state($key, &$sbox0, &$sbox1, &$sbox2, &$sbox3, &$p) - added:
method Crypt_Blowfish._expandstate($data, $key, &$sbox0, &$sbox1, &$sbox2, &$sbox3, &$p) - added:
method Crypt_Blowfish.bcrypt_pbkdf($pass, $salt, $keylen, $rounds) - added:
method Crypt_Blowfish.isValidEngine($engine) - added:
method Crypt_Blowfish.setKeyLength($length) - added:
method Crypt_DES.isValidEngine($engine) - added:
method Crypt_Hash._computeKey() - added:
method Crypt_RC2._setupMcrypt() - added:
method Crypt_RC2.decrypt($ciphertext) - added:
method Crypt_RC2.encrypt($plaintext) - added:
method Crypt_RC2.getKeyLength() - added:
method Crypt_RC2.isValidEngine($engine) - added:
method Crypt_RC4.isValidEngine($engine) - added:
method Crypt_RC4.setKeyLength($length) - added:
method Crypt_RSA._emsa_pkcs1_v1_5_encode_without_null($m, $emLen) - added:
method Crypt_RSA._raw_encrypt($m) - added:
method Crypt_RSA.getPublicKeyFingerprint($algorithm = …) - added:
method Crypt_Rijndael._getInvTables() - added:
method Crypt_Rijndael._getTables() - added:
method Crypt_Rijndael.isValidEngine($engine) - added:
method Crypt_TripleDES.isValidEngine($engine) - added:
method Crypt_TripleDES.setKeyLength($length) - added:
method Crypt_TripleDES.setPreferredEngine($engine) - added:
method Crypt_Twofish.setKeyLength($length) - added:
method File_ANSI._processCoordinate($last_attr, $cur_attr, $char) - added:
method File_ASN1._decodeDateTime($content, $tag) - added:
method File_ASN1._decodeOID($content) - added:
method File_ASN1._decodeUnixTime($content, $tag) - added:
method File_ASN1._encodeOID($source) - added:
method File_X509._decodeNameConstraintIP($ip) - added:
method File_X509._fetchURL($url) - added:
method File_X509._isSubArrayValid($root, $path) - added:
method File_X509._mapInDNs(&$root, $path, $asn1) - added:
method File_X509._mapOutDNs(&$root, $path, $asn1) - added:
method File_X509._subArrayUnchecked(&$root, $path, $create = …) - added:
method File_X509._testForIntermediate($caonly, $count) - added:
method File_X509._validateSignatureCountable($caonly, $count) - added:
method File_X509.disableURLFetch() - added:
method File_X509.enableURLFetch() - added:
method File_X509.getOID($name) - added:
method File_X509.setRecurLimit($count) - added:
method File_X509.setURLFetchCallback($callback) - added:
method Math_BigInteger.__debugInfo() - added:
method Math_BigInteger.__serialize() - added:
method Math_BigInteger.__unserialize($data) - added:
method Math_BigInteger.getLength() - added:
method Math_BigInteger.getLengthInBytes() - added:
method Net_SCP.getLastSCPError() - added:
method Net_SCP.getSCPErrors() - added:
method Net_SFTP._get_lstat_cache_prop($path, $prop) - added:
method Net_SFTP._get_xstat_cache_prop($path, $prop, $type) - added:
method Net_SFTP._init_sftp_connection() - added:
method Net_SFTP._parseTime($key, $flags, &$response) - added:
method Net_SFTP._partial_init_sftp_connection() - added:
method Net_SFTP._precheck() - added:
method Net_SFTP._reset_connection($reason) - added:
method Net_SFTP._reset_sftp() - added:
method Net_SFTP.disableArbitraryLengthPackets() - added:
method Net_SFTP.disableDatePreservation() - added:
method Net_SFTP.disablePathCanonicalization() - added:
method Net_SFTP.enableArbitraryLengthPackets() - added:
method Net_SFTP.enableDatePreservation() - added:
method Net_SFTP.enablePathCanonicalization() - added:
method Net_SFTP.getNegotiatedVersion() - added:
method Net_SFTP.is_readable($path) - added:
method Net_SFTP.is_writable($path) - added:
method Net_SFTP.is_writeable($path) - added:
method Net_SFTP.realpath($path) - added:
method Net_SFTP.setPreferredVersion($version) - added:
method Net_SSH2._array_intersect_first($array1, $array2) - added:
method Net_SSH2._bad_algorithm_candidate($algorithm) - added:
method Net_SSH2._encryption_algorithm_to_crypt_instance($algorithm) - added:
method Net_SSH2._encryption_algorithm_to_key_size($algorithm) - added:
method Net_SSH2._equals($x, $y) - added:
method Net_SSH2._get_open_channel() - added:
method Net_SSH2._handleDisconnect($payload) - added:
method Net_SSH2._on_channel_open() - added:
method Net_SSH2._reconnect() - added:
method Net_SSH2._reset_connection($reason) - added:
method Net_SSH2._updateLogHistory($old, $new) - added:
method Net_SSH2.bytesUntilKeyReexchange($bytes) - added:
method Net_SSH2.disableSmartMFA() - added:
method Net_SSH2.enableSmartMFA() - added:
method Net_SSH2.getAlgorithmsNegotiated() - added:
method Net_SSH2.getAuthMethodsToContinue() - added:
method Net_SSH2.getServerAlgorithms() - added:
method Net_SSH2.getSupportedCompressionAlgorithms() - added:
method Net_SSH2.getSupportedEncryptionAlgorithms() - added:
method Net_SSH2.getSupportedHostKeyAlgorithms() - added:
method Net_SSH2.getSupportedKEXAlgorithms() - added:
method Net_SSH2.getSupportedMACAlgorithms() - added:
method Net_SSH2.getTimeout() - added:
method Net_SSH2.isAuthenticated() - added:
method Net_SSH2.ping() - added:
method Net_SSH2.sendIdentificationStringFirst() - added:
method Net_SSH2.sendIdentificationStringLast() - added:
method Net_SSH2.sendKEXINITFirst() - added:
method Net_SSH2.sendKEXINITLast() - added:
method Net_SSH2.setCryptoEngine($engine) - added:
method Net_SSH2.setKeepAlive($interval) - added:
method Net_SSH2.setPreferredAlgorithms($methods) - added:
method System_SSH_Agent._forward_data($data) - added:
method System_SSH_Agent._on_channel_open($ssh) - added:
method System_SSH_Agent._request_forwarding($ssh) - added:
method System_SSH_Agent.startSSHForwarding() - added:
method System_SSH_Agent_Identity._string_shift(&$string, $index = …) - added:
method System_SSH_Agent_Identity.setHash($hash) - added:
property Crypt_Base.cipher_name_openssl - added:
property Crypt_Base.cipher_name_openssl_ecb - added:
property Crypt_Base.explicit_key_length - added:
property Crypt_Base.openssl_emulate_ctr - added:
property Crypt_Base.openssl_options - added:
property Crypt_Base.preferredEngine - added:
property Crypt_Base.skip_key_adjustment - added:
property Crypt_Blowfish.key_length - added:
property Crypt_Blowfish.sha512 - added:
property Crypt_DES.key_length - added:
property Crypt_DES.key_length_max - added:
property Crypt_DES.kl - added:
property Crypt_DES.openssl_mode_names - added:
property Crypt_Hash.computedKey - added:
property Crypt_Hash.engine - added:
property Crypt_RC2.current_key_length - added:
property Crypt_RC2.key_length - added:
property Crypt_RC2.orig_key - added:
property Crypt_RC2.skip_key_adjustment - added:
property Crypt_RC4.key_length - added:
property Crypt_Rijndael.key_length - added:
property Crypt_TripleDES.key_length - added:
property Crypt_TripleDES.key_length_max - added:
property Crypt_Twofish.key_length - added:
property File_ANSI.attr_cell - added:
property File_ANSI.base_attr_cell - added:
property File_ANSI.tokenization - added:
property File_ASN1.location - added:
property File_X509.PostalAddress - added:
property File_X509.SubjectDirectoryAttributes - added:
property File_X509.SubjectInfoAccessSyntax - added:
property File_X509.disable_url_fetch - added:
property File_X509.recur_limit - added:
property File_X509.urlFetchCallback - added:
property Net_SCP.scp_errors - added:
property Net_SFTP.allow_arbitrary_length_packets - added:
property Net_SFTP.attributes - added:
property Net_SFTP.canonicalize_paths - added:
property Net_SFTP.channel_close - added:
property Net_SFTP.defaultVersion - added:
property Net_SFTP.file_types - added:
property Net_SFTP.open_flags - added:
property Net_SFTP.open_flags5 - added:
property Net_SFTP.partial_init - added:
property Net_SFTP.preferredVersion - added:
property Net_SFTP.preserveTime - added:
property Net_SFTP.requestBuffer - added:
property Net_SFTP.use_request_id - added:
property Net_SSH1.log_size - added:
property Net_SSH1.protocol_flags_log - added:
property Net_SSH2.agent - added:
property Net_SSH2.auth - added:
property Net_SSH2.auth_methods_to_continue - added:
property Net_SSH2.bad_key_size_fix - added:
property Net_SSH2.binary_packet_buffer - added:
property Net_SSH2.bytesTransferredSinceLastKEX - added:
property Net_SSH2.compress - added:
property Net_SSH2.compress_context - added:
property Net_SSH2.crypto_engine - added:
property Net_SSH2.decompress - added:
property Net_SSH2.decompress_context - added:
property Net_SSH2.decryptName - added:
property Net_SSH2.doKeyReexchangeAfterXBytes - added:
property Net_SSH2.encryptName - added:
property Net_SSH2.hmac_check_name - added:
property Net_SSH2.keepAlive - added:
property Net_SSH2.kex_algorithm - added:
property Net_SSH2.kex_buffer - added:
property Net_SSH2.kex_dh_group_size_max - added:
property Net_SSH2.kex_dh_group_size_min - added:
property Net_SSH2.kex_dh_group_size_preferred - added:
property Net_SSH2.keyExchangeInProgress - added:
property Net_SSH2.login_credentials_finalized - added:
property Net_SSH2.preferred - added:
property Net_SSH2.preferred_signature_format - added:
property Net_SSH2.regenerate_compression_context - added:
property Net_SSH2.regenerate_decompression_context - added:
property Net_SSH2.send_id_string_first - added:
property Net_SSH2.send_kex_first - added:
property Net_SSH2.smartMFA - added:
property Net_SSH2.strict_kex_flag - added:
property Net_SSH2.supported_private_key_algorithms - added:
property Net_SSH2.window_resize - added:
property System_SSH_Agent.expected_bytes - added:
property System_SSH_Agent.forward_status - added:
property System_SSH_Agent.socket_buffer - added:
property System_SSH_Agent_Identity.flags