The update for PHP 8 fixes several security issues: CVE-2025-14179 resolves an SQL injection vulnerability due to improper handling of NULL bytes in the PDO Firebird driver. CVE-2026-6104 addresses an out-of-bounds read in mb_convert_encoding() caused by embedded NULL bytes, potentially leading to information disclosure and denial of service. CVE-2026-6722 fixes a use-after-free vulnerability in SOAP with Apache map that could enable remote code execution. CVE-2026-6735 corrects improper validation in the PHP-FPM status page that could lead to XSS. CVE-2026-7258 mitigates out-of-bounds access and denial of service from signed char values passed to ctype functions. CVE-2026-7259, CVE-2026-7262, and CVE-2026-7263 address NULL pointer dereferences and infinite loops causing denial of service in mbstring and SOAP processing and DOMNode XML canonicalization. CVE-2026-7261 fixes use-after-free issues in SOAP persistence that could cause memory corruption and information disclosure. CVE-2026-7568 resolves an integer overflow in the metaphone function that could affect process availability. The update includes an upgrade to PHP 8.4.21.

These vulnerabilities collectively impact the confidentiality, integrity, and availability of PHP 8 applications. They enable potential SQL injection, remote code execution, cross-site scripting, information disclosure, denial of service, memory corruption, and process crashes. Exploitation could allow attackers to execute arbitrary code, disrupt service, or leak sensitive information.

A security update is available that addresses all listed vulnerabilities by upgrading PHP to version 8.4.21. Users should apply this official fix promptly to mitigate the risks. No additional vendor advisories indicate alternative mitigations or that no action is required.