PHP: Three Vulnerabilities Including SQLi and Memory Corruption Disclosed Together
Key findings • Three PHP vulnerabilities disclosed on July 31, 2026, including SQL injection and memory corruption flaws. • CVE-2026-17543 allows SQL injection via improper backslash escaping…
Key findings
- Three PHP vulnerabilities disclosed on July 31, 2026, including SQL injection and memory corruption flaws.
- CVE-2026-17543 allows SQL injection via improper backslash escaping in the PostgreSQL extension.
- CVE-2026-17544 enables out-of-bounds writes due to insufficient input validation in bccomp().
- CVE-2026-7260 causes denial-of-service through unbounded recursion in Phar archives.
- Affected PHP versions range from 8.2.x to 8.5.x, patched in releases 8.2.33, 8.3.33, 8.4.24, and 8.5.9.
On July 31, 2026, PHP released security updates to address three vulnerabilities, including flaws that could lead to SQL injection, out-of-bounds memory writes, and denial-of-service conditions. These issues affect various PHP versions and were disclosed together, highlighting the importance of timely patching for the widely used scripting language.
Two of the vulnerabilities stem from improper handling of attacker-provided inputs. CVE-2026-17544, an out-of-bounds write vulnerability, arises from insufficient checks on inputs to the bccomp() function. This could allow an attacker to corrupt the stack and heap memory. Affected versions include PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9.
Similarly, CVE-2026-17543 is a critical SQL injection vulnerability caused by improper escaping of backslashes in parameters. This flaw affects the ext-pgsql extension, specifically within the php_pgsql_convert() function used by convenience functions like pg_insert(), pg_update(), pg_select(), and pg_delete(). This vulnerability impacts PHP versions 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9.
The third vulnerability, CVE-2026-7260, relates to the ext-phar extension. Circular symbolic links within Phar archives could trigger unbounded recursion, leading to a crash of the PHP process due to stack exhaustion. This issue affects the same broad range of PHP versions as the other two vulnerabilities.
PHP has addressed these vulnerabilities in its maintenance releases. Users are strongly advised to update to the patched versions: PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9, or later. Promptly applying these updates is crucial for mitigating the risks associated with SQL injection, memory corruption, and denial-of-service attacks. The coordinated disclosure of these flaws underscores the ongoing need for vigilance in securing web application environments.