PHP oci_password_change() ORA-1017 gotcha with Oracle Database 184.108.40.206
The Oracle Instant Client 220.127.116.11 for Linux is now available on OTN. I know many users will upgrade sooner rather than later to get the "latest and greatest" release.
However, if your PHP application uses oci_password_change (or its old alias ocipasswordchange), you should upgrade the client libraries (Instant or normal "full" client) and the Oracle Database version to 18.104.22.168 at the same time. Otherwise oci_password_change will fail with the error "ORA-1017: invalid username/password". If you're not using oci_password_change then this won't impact you.
Since the protocol change is in the Oracle libraries, the change is not just limited PHP. Any C program using Oracle's Call Interface "OCIPasswordChange" API to change passwords will also have the same restrictions.