THREAT OPS › Threat News › [GHSA] GHSA-8jqh-95g6-7jpj (high) — Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)
[GHSA] GHSA-8jqh-95g6-7jpj (high) — Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)
GHSA-8jqh-95g6-7jpj Severity: high CVE: CVE-2026-54736
Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)
## Summary
`Phalcon\Encryption\Crypt` provides authenticated encryption: when `useSigning` is enabled (the default), `encrypt()` appends an HMAC tag and `decrypt()` verifies it before returning the plaintext. The verification compares the attac
Indicators of compromise
- CVE-2026-54736cve
- CVE-2009-0654cve
Original source: https://github.com/advisories/GHSA-8jqh-95g6-7jpj