A critical security issue affecting PHP has been identified and fixed, involving two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow unauthenticated remote code execution via memory corruption triggered by out-of-memory conditions. The UK NCSC urges organisations using any PHP version to update to the latest fixed release or apply temporary mitigations if immediate update is not possible. The vulnerabilities affect all PHP versions, with older versions particularly encouraged to upgrade to supported releases. Organisations should prioritize internet-facing systems for remediation and monitor for further updates.
CVE-2026-7260 is a stack-based buffer overflow vulnerability in PHP caused by circular symbolic links in phar archives. This flaw can trigger unbounded recursion, exhausting the C stack and crashing the PHP process. It affects PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation level is currently confirmed in the provided data.
CVE-2026-17544 is a high-severity vulnerability in the PHP programming language affecting versions 8.4.0 through 8.4.23 and 8.5.0 through 8.5.8. It involves an out-of-bounds write triggered by attacker-controlled inputs to the bccomp() function, which can cause stack and heap corruption. This vulnerability could potentially lead to serious memory corruption issues. No official patch or remediation level has been confirmed yet.
CVE-2026-17543 is a high-severity SQL injection vulnerability in PHP caused by improper escaping of backslashes in attacker-supplied parameters. It affects multiple PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. This flaw allows attackers to perform SQL injection attacks due to improper neutralization of special elements in SQL commands. No official patch or remediation level is currently confirmed.
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.