PHP maintainers have launched safety updates to handle three vulnerabilities affecting the PostgreSQL, BCMath, and Phar extensions. These vulnerabilities might doubtlessly result in SQL injection assaults, out-of-bounds reminiscence writes, and denial-of-service assaults in weak purposes.
The problems affect a number of actively maintained PHP launch branches and have been resolved in variations PHP 8.2.338.2, 8.3.338.3, 8.4.248.4, and eight.5.98.5, relying on the affected extension.
Organizations working PHP purposes ought to prioritize upgrading, particularly if their purposes course of untrusted database enter, carry out BCMath operations on user-controlled values, or deal with Phar archives.
PHP Patches 3 Safety Flaws
Probably the most essential situation, tracked as CVE-2026-17543 and GHSA-7qpv-r5mr-78m4, is a high-severity SQL injection vulnerability in PHP’s PostgreSQL extension (ext-pgsql).
This flaw is discovered within the operate php_pgsql_convert(), which is utilized by comfort features similar to pg_insert(), pg_update(), pg_select(), and pg_delete() to transform and escape user-supplied parameters.
Earlier than the replace, this operate utilized PostgreSQL’s PQescapeStringConn() operate. It wrapped the ensuing values in an escape string fixed formatted as E’…’.
This strategy turns into unsafe when PostgreSQL makes use of the standard_conforming_strings setting, which has been enabled by default since PostgreSQL model 9.19.
With this configuration, PQescapeStringConn() fails to flee backslash characters appropriately for values that will likely be embedded inside an E’…’ string.
An attacker who can affect a parameter handed to one among these helper features might insert a backslash adopted by a quote, breaking out of the meant SQL string context.
The remaining enter could then be handled as legitimate SQL syntax, permitting the attacker to change question logic, doubtlessly entry unauthorized data, or manipulate database content material, relying on the applying’s privileges.
PHP’s repair alters the parameter dealing with logic to make use of non-escaping string constants as an alternative of wrapping escaped values in E’…’. This vulnerability was reported by ExPatch-LLC, with evaluation and remediation supported by PHP contributors.
A second high-severity vulnerability, CVE-2026-17544 (GHSA-x692-q9x7-8c3f), impacts the BCMath extension in PHP variations 8.48 and eight.58.
This situation can result in an out-of-bounds write when an software calls the bccomp() operate with attacker-controlled numeric operands and a maliciously crafted scale worth.
The error happens within the bc_str2num() operate when a manually specified scale truncates decimal digits, and subsequent logic removes trailing zeroes.
Whereas the code reduces the calculated scale and allocates a smaller numeric buffer, it beforehand retained the unique pointer to the fractional finish through the copy operation.
In consequence, PHP might find yourself copying extra knowledge than the newly allotted buffer can accommodate, doubtlessly corrupting stack or heap reminiscence.
BCMath initially makes use of a small stack-based reminiscence space earlier than switching to heap allocation, that means the affect could differ based mostly on the enter and execution atmosphere.
Reminiscence corruption vulnerabilities can result in software crashes and, in sure circumstances, could present attackers with a path for extra extreme exploitation.
The patch corrects the pointer dealing with after zero truncation, guaranteeing that copied knowledge aligns with the decreased allocation measurement. Safety researcher Recep Asan reported this flaw.
The third vulnerability, CVE-2026-7260, entails the Phar extension and is rated as reasonable severity. This situation, tracked as GHSA-vc5h-9ppw-p5f3, arises from uncontrolled recursion within the operate phar_get_link_source() when resolving symbolic hyperlinks in Phar archives.
A malicious tar-based Phar archive containing round symbolic hyperlinks could trigger the operate to repeatedly observe hyperlinks with none recursion depth restrict or cycle detection mechanism.
This unchecked recursion can exhaust the PHP course of’s C stack, leading to a segmentation fault and course of termination.
This Phar-related situation is assessed underneath CWE-400 (uncontrolled useful resource consumption) and CWE-674 (uncontrolled recursion).
Its CVSS 3.1 vector means that exploitation requires native assault entry, has low complexity, requires no further privileges, requires consumer interplay, and has a major affect on availability.
Though exploiting this vulnerability requires an software or consumer to course of a malicious archive, affected programs could also be in danger when add portals, construct pipelines, package-management workflows, or file-processing companies settle for untrusted .phar or .tar content material.
The problem was reported by Calvin Younger of eWalker Consulting and Enoch Chow of Isomorph Cyber. Directors are urged to promptly improve PHP, evaluate dependencies that invoke the affected extensions, and keep away from counting on application-level enter filtering as an alternative choice to patched runtime variations.
ALERT: 20+ authorities websites delivered malware to companies and residents. See full assault analysis to verify your personal publicity.
