PHP Patches Critical SQL Injection, Memory Corruption Flaws

Key Takeaways

• PHP has released critical security updates addressing three vulnerabilities across its optional extensions.
• High-severity flaws include a SQL injection vulnerability in the PostgreSQL extension and a memory corruption bug in the BCMath extension.
• A moderate-severity denial-of-service vulnerability affects the Phar extension.
• These issues impact widely used web application components, particularly those processing untrusted input or archive files.
• Users are strongly advised to update to PHP versions 8.2.33, 8.3.33, 8.4.24, or 8.5.9 immediately.

PHP has rolled out essential security patches in its most recent maintenance releases, targeting three distinct vulnerabilities. These updates address significant flaws, including critical issues that could lead to SQL injection attacks and out-of-bounds memory writes in widely deployed web applications.

The vulnerabilities are present in optional PHP extensions: ext-pgsql, ext-bcmath, and ext-phar. Organizations must prioritize updating their PHP installations, especially if their applications handle untrusted user input or manage uploaded archive files, to mitigate potential exploitation risks.

Critical SQL Injection in PostgreSQL Extension

The most severe vulnerability, identified as CVE-2026-17543, resides within the PostgreSQL extension. This flaw specifically impacts the php_pgsql_convert() function, which is integral to convenience functions such as pg_insert(), pg_update(), pg_select(), and pg_delete(). The core issue stems from how user-supplied values are escaped using PQescapeStringConn().

The system then inserts the escaped result into a string constant formatted as E’…’. However, when PostgreSQL’s standard_conforming_strings setting is enabled (a default configuration since PostgreSQL version 9.19.19.1), backslashes are not properly escaped in this specific context, creating a critical bypass.

Attackers could leverage this flaw to inject arbitrary SQL commands, potentially gaining unauthorized access to sensitive database information or modifying existing data. PHP has resolved this vulnerability by implementing non-escaping string constants for these parameters, thereby eliminating the injection vector.

High-Severity Memory Corruption in BCMath Extension

A second high-severity vulnerability, tracked as CVE-2026-17544, affects the BCMath extension, specifically within its bccomp() function. This issue manifests when an application processes attacker-controlled numeric strings alongside a particular scale value.

The bug originates in the bc_str2num() function. Here, PHP truncates fractional digits and removes trailing zeroes. Crucially, while the allocated buffer size was reduced, the pointer indicating the end of the copied fractional data was not consequently updated. This discrepancy meant PHP could attempt to copy more data than the buffer could safely hold, resulting in an out-of-bounds write that could corrupt stack or heap memory.

Depending on the specific application environment and PHP runtime conditions, such memory corruption bugs can lead to application crashes or open avenues for more sophisticated exploitation. The implemented patch rectifies this by ensuring the fractional endpoint is correctly updated after zero truncation, aligning the copied data with the allocated buffer size.

Moderate Denial-of-Service in Phar Extension

The third vulnerability, identified as CVE-2026-7260, impacts the Phar extension and can cause PHP processes to terminate unexpectedly. This flaw stems from the phar_get_link_source() function, which recursively follows symbolic links embedded within Phar archives without enforcing a recursion depth limit or detecting circular references.

A specially crafted tar-based Phar archive containing circular symbolic links could trigger an infinite recursion loop, leading PHP to crash with a segmentation fault. This results in a denial-of-service (DoS) condition, rated with a CVSS score of 6.5 (moderate severity).

Exploitation of this Phar flaw requires a user or application to process the malicious archive. However, it poses a risk to services that automatically inspect, extract, or read uploaded files, potentially disrupting their operations.

What You Should Do

• Update PHP Immediately: Upgrade all affected PHP installations to versions 8.2.33, 8.3.33, 8.4.24, or 8.5.9 without delay.
• Review Application Dependencies: Administrators should scrutinize applications that rely on PostgreSQL helper functions, BCMath operations processing external input, and file-upload workflows that parse Phar or tar archives.
• Input Validation: Implement robust input validation and sanitization for all user-supplied data, especially when interacting with database functions or numeric calculations.
• Monitor Logs: Continuously monitor application and system logs for any unusual activity or crashes that might indicate attempted exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.