The PHP development team has disclosed three security vulnerabilities affecting core extensions, with fixes shipped in PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9.
The flaws span SQL injection, uncontrolled recursion, and out-of-bounds memory writes, impacting applications that rely on ext-pgsql, ext-phar, and ext-bcmath.
Security researcher iluuu1994 published all three advisories on GitHub Security Advisories. The most severe of the three, rated High, is CVE-2026-17543, an SQL injection vulnerability in php_pgsql_convert().
Critical PHP Vulnerabilities
This function backs pg_insert(), pg_update(), pg_select(), and pg_delete(), using PQescapeStringConn() to sanitize input before wrapping it in a PostgreSQL escape string constant (E'...') via php_pgsql_add_quotes().
The issue arises because PQescapeStringConn() doesn’t escape backslash characters when standard_conforming_strings is enabled, the PostgreSQL default since version 9.1.
Since E'...' syntax treats backslashes as escape characters, an attacker can supply a value like zzz\' OR 1=1 --, causing the escaped single quote to be treated as literal while the second quote terminates the string early, exposing the rest of the payload to SQL parsing.
A crafted pg_select() call demonstrates full query bypass, returning all rows regardless of the intended filter. The fix changes php_pgsql_convert() to use non-escaping string constants instead.
Rated Moderate, CVE-2026-7260 affects ext-phar. The function phar_get_link_source() in util.c recursively resolves symbolic links inside phar archives without depth limiting or cycle detection.
An attacker can craft a tar-based phar archive containing two symlinks pointing to each other, triggering infinite recursion the moment the entry content is accessed (e.g., via getContent()).
This exhausts the C call stack and crashes the PHP process a denial-of-service condition (CWE-400, CWE-674) requiring local access and user interaction but no privileges.
The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) reflects high availability impact with no confidentiality or integrity loss. Also rated High, CVE-2026-17544 stems from a truncation bug in bc_str2num() within ext-bcmath.
When bccomp() processes an operand whose decimal scale gets truncated and trailing zeros subsequently trimmed, the code recalculates str_scale but fails to adjust the corresponding fractional_end pointer.
This mismatch causes bc_copy_and_toggle_bcd() to copy the untruncated string into an undersized buffer.
Because BCMath uses a stack-allocated arena before falling back to heap allocation, exploitation can corrupt either stack or heap memory depending on allocation context (CWE-121, CWE-787). The patch simply reassigns fractional_end = fractional_new_end; after zero-trimming.
Mitigation
All three vulnerabilities affect PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9 (the Phar and BCMath issues apply from 8.4 onward). Organizations running PHP applications that interact with PostgreSQL, perform arbitrary-precision arithmetic.
Processes that untrusted Phar archives should prioritize upgrading immediately, particularly given the SQL injection flaw’s potential for data exfiltration and the memory corruption bug’s potential for exploitation.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
