PHP has addressed three security vulnerabilities in its latest maintenance releases, including high-severity flaws that can expose applications to SQL injection and out-of-bounds memory writes.
These vulnerabilities affect optional PHP extensions commonly used by web applications: ext-pgsql, ext-bcmath, and ext-phar. Organizations are urged to update their PHP installations promptly, especially if their applications process untrusted input or handle uploaded archive files.
The most critical issue, tracked as CVE-2026-17543, affects the PostgreSQL extension. This flaw exists in the php_pgsql_convert() function, which is used by convenience functions such as pg_insert(), pg_update(), pg_select(), and pg_delete(). The vulnerable code escapes user-supplied values using PQescapeStringConn().
Then it places the result into an escape string constant formatted as E’…’. With PostgreSQL’s standard_conforming_strings setting enabled (which has been the default since PostgreSQL version 9.19.19.1), backslashes are not safely escaped in this context.
PHP Patches Three Flaws
An attacker could exploit the flaw to inject SQL commands, potentially accessing or modifying database data. PHP fixed the issue by using non-escaping string constants when processing these parameters.
The second high-severity vulnerability, CVE-2026-17544, impacts the BCMath extension’s bccomp() function. This issue arises when an application passes attacker-controlled numeric strings along with a specific scale value.
The bug is located in bc_str2num(), where PHP truncates fractional digits and removes trailing zeroes. The code reduced the allocated buffer size but did not update the pointer defining the end of the copied fractional data.
Consequently, PHP could copy more data than the allocated buffer can hold, leading to an out-of-bounds write that may corrupt stack or heap memory.
Depending on the application conditions and the PHP runtime environment, memory corruption bugs can lead to crashes or create pathways for more serious exploitation. The patch updates the fractional endpoint after zero truncation, ensuring that the copied data matches the allocated buffer size.
The third flaw, tracked as CVE-2026-7260, affects the Phar extension and can cause PHP processes to crash. This vulnerability stems from the phar_get_link_source() function, which recursively follows symbolic links stored in Phar archives without enforcing a recursion depth limit or detecting circular references.
A malicious tar-based Phar archive with circular symbolic links could trigger infinite recursion, causing PHP to crash with a segmentation fault and resulting in a moderate-severity denial-of-service (CVSS 6.5).
The Phar flaw requires a user or application to process a crafted archive. However, it may still disrupt services that automatically inspect, extract, or read uploaded files.
Affected users should upgrade to PHP versions 8.2.33, 8.3.33, 8.4.24, or 8.5.9. PHP administrators should also review applications that rely on PostgreSQL helper functions, BCMath operations with externally supplied values, and file-upload workflows that parse Phar or tar archives.
