diff --git a/CVE-2026-14355.patch b/CVE-2026-14355.patch
new file mode 100644
index 0000000000000000000000000000000000000000..e45ff27012d8a493e2725300138d38b9a3f3d47c
--- /dev/null
+++ b/CVE-2026-14355.patch
@@ -0,0 +1,87 @@
+From 169226847426368c62992af43c2c39b0fdbff4d5 Mon Sep 17 00:00:00 2001
+From: David Carlier <devnexen@gmail.com>
+Date: Fri, 29 May 2026 21:44:14 +0100
+Subject: [PATCH] Backport 169226847426 to fix CVE-2026-14355
+
+Upstream: https://github.com/php/php-src/commit/169226847426368c62992af43c2c39b0fdbff4d5
+
+---
+ ext/openssl/openssl.c          |  17 +++++++++++++++--
+ ext/openssl/tests/gh22186.phpt |  32 ++++++++++++++++++++++++++++++
+ 2 files changed, 47 insertions(+), 2 deletions(-)
+
+--- a/ext/openssl/openssl.c
++++ b/ext/openssl/openssl.c
+@@ -7616,6 +7616,7 @@
+ 		const char *aad, size_t aad_len, int enc)  /* {{{ */
+ {
+ 	int i = 0;
++	size_t outlen = data_len + EVP_CIPHER_block_size(cipher_type);
+
+ 	if (mode->is_single_run_aead && !EVP_CipherUpdate(cipher_ctx, NULL, &i, NULL, (int)data_len)) {
+ 		php_openssl_store_errors();
+@@ -7629,7 +7630,19 @@
+ 		return FAILURE;
+ 	}
+
+-	*poutbuf = zend_string_alloc((int)data_len + EVP_CIPHER_block_size(cipher_type), 0);
++#ifdef EVP_CIPH_WRAP_MODE
++	if ((EVP_CIPHER_mode(cipher_type)) == EVP_CIPH_WRAP_MODE) {
++		/*
++		 * RFC 5649 wrap-with-padding rounds the input up to the block size
++		 * and prepends an integrity block, we reserve one extra block.
++		 * See EVP_EncryptUpdate(3): wrap mode may write up to
++		 * inl + cipher_block_size bytes.
++		 */
++		outlen += EVP_CIPHER_block_size(cipher_type);
++	}
++#endif
++
++	*poutbuf = zend_string_alloc(outlen, false);
+
+ 	if (!EVP_CipherUpdate(cipher_ctx, (unsigned char*)ZSTR_VAL(*poutbuf),
+ 					&i, (const unsigned char *)data, (int)data_len)) {
+@@ -7641,7 +7654,7 @@
+ 		}
+ 		*/
+ 		php_openssl_store_errors();
+-		zend_string_release_ex(*poutbuf, 0);
++		zend_string_release_ex(*poutbuf, false);
+ 		return FAILURE;
+ 	}
+
+--- /dev/null
++++ b/ext/openssl/tests/gh22186.phpt
+@@ -0,0 +1,32 @@
++--TEST--
++GH-22186 (Heap buffer overflow in openssl_encrypt with AES-WRAP-PAD)
++--EXTENSIONS--
++openssl
++--SKIPIF--
++<?php
++/* openssl_get_cipher_methods() enumerates provider ciphers, but openssl_encrypt()
++ * resolves names via the legacy EVP_get_cipherbyname(), so on some builds the
++ * cipher is listed yet not usable. Probe the actual call path instead. */
++if (!@openssl_encrypt("test", "aes-128-wrap-pad", str_repeat("k", 16),
++        OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, str_repeat("\0", 4))) {
++    die('skip aes-128-wrap-pad not usable on this OpenSSL build');
++}
++?>
++--FILE--
++<?php
++$pass = str_repeat("k", 16);
++$iv = str_repeat("\0", 4);
++
++for ($i = 1; $i < 258; $i++) {
++    $data = str_repeat("a", $i);
++    $enc = openssl_encrypt($data, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
++    $dec = openssl_decrypt($enc, 'aes-128-wrap-pad', $pass, OPENSSL_RAW_DATA | OPENSSL_DONT_ZERO_PAD_KEY, $iv);
++    if ($dec !== $data) {
++        die("mismatch at $i\n");
++    }
++}
++
++echo "done\n";
++?>
++--EXPECT--
++done
diff --git a/php.spec b/php.spec
index 556428228b120c8fac33fe91850b4e0b64e6d473..40c7245e01cfacee1a4efa4b776480cb8b804955 100644
--- a/php.spec
+++ b/php.spec
@@ -1,4 +1,4 @@
-%define anolis_release 1
+%define anolis_release 2
 
 # API/ABI check
 %global apiver      20230831
@@ -94,6 +94,9 @@ Patch49: php-8.3.7-argon2.patch
 # Fixes for tests (300+)
 # Factory is droped from system tzdata
 Patch300: php-7.4.0-datetests.patch
+# CVE-2026-14355
+# Reference: https://github.com/php/php-src/commit/169226847426368c62992af43c2c39b0fdbff4d5
+Patch301: CVE-2026-14355.patch
 
 
 BuildRequires: gnupg2
@@ -669,6 +672,7 @@ bytecode optimization patterns that make code execution faster.
 
 %prep
 %setup -q -n php-%{version}
+%patch301 -p1
 
 %patch -P 1 -p1 -b .mpmcheck
 %patch -P 5 -p1 -b .includedir
@@ -1505,6 +1509,11 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
 
 
 %changelog
+* Thu Aug 06 2026 PengLAI Code <rel-eng@openanolis.org> - 8.3.31-2
+- Fix CVE-2026-14355
+- Upstream patch: https://github.com/php/php-src/commit/169226847426368c62992af43c2c39b0fdbff4d5
+- Adapted by PengLAI Code
+
 * Wed May 27 2026 tomcruiseqi <tomcruiseqi@inspur.com> - 8.3.31-1
 - Update to 8.3.31
 - Fix CVE-2026-7568, CVE-2026-7262, CVE-2026-6735, CVE-2026-6722