phpseclib CVE-2026-84308

Exploitation requires four simultaneous conditions to be present. First, the target application must use a reused or long-lived X25519 private key - the description explicitly states that ephemeral keys, including those in phpseclib's SSH key exchange path, are not affected. Second, the pure-PHP arithmetic code path must be active: for the PKCS8 key-load path, ext-sodium must be absent; for the MontgomeryPrivate key loader, the vulnerability was present unconditionally prior to the fix because that loader bypassed native-engine selection entirely. Third, the attacker must be a local observer capable of resolving individual Montgomery ladder step timings or libgmp call-count differences, requiring co-location on the same physical or virtual host with sufficient clock resolution. Fourth, the attacker must know the corresponding public key. Applications using ephemeral keys, running with ext-sodium enabled, or operating on isolated single-tenant infrastructure face no realistic exploitation risk.

The CVSS base score of 6.3 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the constrained exploitation requirements, and the C:H/I:H impact metrics should not be read in isolation. Real-world risk is substantially limited by four simultaneous prerequisites that must all be present: key reuse, the pure-PHP code path being active, local timing access, and knowledge of the public key. EPSS data was not provided, and this CVE is not in CISA KEV; exploitation probability and active exploitation status are unknown. No public proof-of-concept code has been identified. The SSH use case - arguably the most common phpseclib deployment - is explicitly excluded because ephemeral keys are generated per session. The realistic target population is applications that explicitly load and reuse static X25519 keys for persistent encrypted channels, TOFU pinning, or similar long-lived key scenarios, deployed on servers where a co-tenant or privileged local process can achieve the timing resolution needed to distinguish individual ladder-step durations. This attack is academically well-understood but operationally difficult to mount; even a mid-sized IT operation managing static X25519 keys in PHP without ext-sodium should prioritize patching over emergency incident response unless shared-tenancy hosting makes timing attacks more feasible.

A local attacker co-resident on the same server as a PHP application using phpseclib without ext-sodium measures per-step timing variation across repeated X25519 key-agreement operations that reuse a static private key. By correlating the data-dependent conditional reduction patterns across sufficient observations - exploiting the fact that libgmp invocation counts vary with the secret scalar prefix - the attacker applies lattice-reduction or similar techniques to recover the full 251-bit clamped private scalar, permanently compromising all sessions keyed with that material. No public proof-of-concept is known at time of analysis, though the underlying academic side-channel technique for Montgomery ladder timing recovery is well established.