PHP Patches 3 Security Flaws Enabling SQL Injection, Memory Corruption and DoS Attacks

PHP maintainers have released security updates to address three vulnerabilities affecting the PostgreSQL, BCMath, and Phar extensions. These vulnerabilities could potentially lead to SQL injection attacks, out-of-bounds memory writes, and denial-of-service attacks in vulnerable applications.

The issues impact several actively maintained PHP release branches and have been resolved in versions PHP 8.2.338.2, 8.3.338.3, 8.4.248.4, and 8.5.98.5, depending on the affected extension.

Organizations running PHP applications should prioritize upgrading, especially if their applications process untrusted database input, perform BCMath operations on user-controlled values, or handle Phar archives.

PHP Patches 3 Security Flaws

The most critical issue, tracked as CVE-2026-17543 and GHSA-7qpv-r5mr-78m4, is a high-severity SQL injection vulnerability in PHP’s PostgreSQL extension (ext-pgsql).

This flaw is found in the function php_pgsql_convert(), which is used by convenience functions such as pg_insert(), pg_update(), pg_select(), and pg_delete() to convert and escape user-supplied parameters.

Before the update, this function utilized PostgreSQL’s PQescapeStringConn() function. It wrapped the resulting values in an escape string constant formatted as E’…’.

This approach becomes unsafe when PostgreSQL uses the standard_conforming_strings setting, which has been enabled by default since PostgreSQL version 9.19.

With this configuration, PQescapeStringConn() fails to escape backslash characters appropriately for values that will be embedded within an E’…’ string.

An attacker who can influence a parameter passed to one of these helper functions could insert a backslash followed by a quote, breaking out of the intended SQL string context.

The remaining input may then be treated as valid SQL syntax, allowing the attacker to alter query logic, potentially access unauthorized records, or manipulate database content, depending on the application’s privileges.

PHP’s fix alters the parameter handling logic to use non-escaping string constants instead of wrapping escaped values in E’…’. This vulnerability was reported by ExPatch-LLC, with analysis and remediation supported by PHP contributors.

A second high-severity vulnerability, CVE-2026-17544 (GHSA-x692-q9x7-8c3f), affects the BCMath extension in PHP versions 8.48 and 8.58.

This issue can lead to an out-of-bounds write when an application calls the bccomp() function with attacker-controlled numeric operands and a maliciously crafted scale value.

The error occurs in the bc_str2num() function when a manually specified scale truncates decimal digits, and subsequent logic removes trailing zeroes.

While the code reduces the calculated scale and allocates a smaller numeric buffer, it previously retained the original pointer to the fractional end during the copy operation.

As a result, PHP could end up copying more data than the newly allocated buffer can accommodate, potentially corrupting stack or heap memory.

BCMath initially uses a small stack-based memory area before switching to heap allocation, meaning the impact may vary based on the input and execution environment.

Memory corruption vulnerabilities can lead to application crashes and, in certain cases, may provide attackers with a path for more severe exploitation.

The patch corrects the pointer handling after zero truncation, ensuring that copied data aligns with the reduced allocation size. Security researcher Recep Asan reported this flaw.

The third vulnerability, CVE-2026-7260, involves the Phar extension and is rated as moderate severity. This issue, tracked as GHSA-vc5h-9ppw-p5f3, arises from uncontrolled recursion in the function phar_get_link_source() when resolving symbolic links in Phar archives.

A malicious tar-based Phar archive containing circular symbolic links may cause the function to repeatedly follow links without any recursion depth limit or cycle detection mechanism.

This unchecked recursion can exhaust the PHP process’s C stack, resulting in a segmentation fault and process termination.

This Phar-related issue is classified under CWE-400 (uncontrolled resource consumption) and CWE-674 (uncontrolled recursion).

Its CVSS 3.1 vector suggests that exploitation requires local attack access, has low complexity, requires no additional privileges, requires user interaction, and has a significant impact on availability.

Although exploiting this vulnerability requires an application or user to process a malicious archive, affected systems may be at risk when upload portals, build pipelines, package-management workflows, or file-processing services accept untrusted .phar or .tar content.

The issue was reported by Calvin Young of eWalker Consulting and Enoch Chow of Isomorph Cyber. Administrators are urged to promptly upgrade PHP, review dependencies that invoke the affected extensions, and avoid relying on application-level input filtering as a substitute for patched runtime versions.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.