—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Multiple Vulnerabilities in PHP

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: HIGH

Software Affected

PHP version prior to 8.5.9

PHP version prior to 8.4.24

PHP version prior to 8.3.33

PHP version prior to 8.2.33

Overview

Multiple vulnerabilities have been reported in PHP that could be exploited by an attacker to cause memory corruption, execute SQL injection attacks, trigger denial-of-service (DoS) conditions, and potentially compromise application integrity.

Target Audience:

Enterprises, Government Organizations, Cloud Service Providers, Hosting Providers and Web Developers using PHP.

Risk Assessment:

High risk of denial of service, memory corruption, SQL injection, application crashes and information disclosure.

Impact Assessment:

Successful exploitation of these vulnerabilities could allow a potential attacker to cause for denial of service, information disclosure and possible arbitrary code execution depending on application usage.

Description

PHP is an open-source scripting language designed for server-side web development, enabling the creation of dynamic web pages.

Multiple vulnerabilities have been identified in PHP affecting several core components and extensions. These vulnerabilities arise due to improper bounds checking, out-of-bounds write operations, SQL injection caused by improper handling of PostgreSQL escaped strings, recursive symbolic link processing, and vulnerabilities inherited from third-party libraries.

An attacker could exploit these vulnerabilities by supplying specially crafted application input, malicious PostgreSQL queries, specially crafted Phar archives, or malformed image files depending on the affected component.

Successful exploitation of these vulnerabilities could result in memory corruption, SQL injection, denial-of-service, application crashes, information disclosure and potential arbitrary code execution.

Solution

Apply appropriate updates as mentioned in the PHP Security Bulletin:

https://www.php.net/ChangeLog-8.php

Vendor Information

PHP

https://www.php.net

References

 

https://www.php.net/ChangeLog-8.php

CVE Name

CVE-2026-17544

CVE-2026-17543

CVE-2026-7260

CVE-2026-9672

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmpzRE4ACgkQ3jCgcSdc

ys8A+Q/+KS+yMgy5Lz2ICgiZk3o6n5EJw58yfExYbQ2FH2GmgHMVGfQYvYIO+hVf

LMgSLbijfxg+p/isUBoR0U7nN18VyUpev2tCR2QmLc/E7fR9UtZjkQ5uNW15UVb9

QEHInuDqtARVI3s9Ekm6HB1rcb9DW/TflI/JuEFsmyvUnuTGluw8Yec3EQ7kC7MC

ftXUOcbHls86OYxgZW3n8G04tUB/nGnU14eRLJbwhCedyn6I9ObNLGi1/BCZ50lR

1WaKgVVnWJNlkq0wVZ/ZmEpVllSOgskqSqZVB2akzYZegzQJAUXm07GgoCj1UaDb

O342kBTf7OzljOkl0aZuS00ESfDbv3a7te/oRiffuhqQeULIQQDZ8fVaqczkMDbG

OXcvPDIb8sqOpgiz8u75drN4FalrPSwfjxHYzm+Lzcb55jLJN6ZDPzegiigXLaKC

QLrHKDELYAT6CaHDflppiGjDh+vMAOkBG3dITaXm/KjmFZrZEjgRmAjh9GQF2Arb

7Syqy/ZK9oXl5fc0B4mdHMIxJAFHnLe4ciK/qmAfQm7XC3lcZaG+VqEHVPJ3c28/

nWvN3GY7i6HJEJP6RHFQMaLwPG43+zDl9Xzg9xJw6CX5btGmoLLBUsSzH2TccCCT

aeqm1OLGmt+GHmEDdr05DloOdpeSMeezw3PpvVaWUIidY+iZ2Ts=

=T3mb

—–END PGP SIGNATURE—–