Loading story…
A use-after-free flaw in PHP's ext-soap component can let attackers achieve remote code execution by sending a crafted SOAP request that abuses apache:Map handling and href references. Tracked as CVE-2026-6722 and GHSA-85c2-q967-79q5, the bug occurs because PHP stores plain object pointers in SOAP_GLOBAL(ref_map) keyed by libxml2 node pointers without increasing the objects' reference counts, allowing stale references to remain after the original object has been freed.
The issue affects PHP 8.2 before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21, and 8.5 before 8.5.6. According to the advisory, duplicate keys in an apache:Map node can trigger object replacement and free the original object while leaving a dangling pointer in the reference map; a later href dereference can then access reclaimed memory, which attackers may shape through subsequent string allocations to gain code execution. PHP fixed the bug by incrementing the object's reference count before inserting it into the map and using safe cleanup logic with ZVAL_PTR_DTOR when processing ends.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A GitHub security advisory disclosed a use-after-free flaw in PHP's ext-soap component that can lead to remote code execution via Apache Map handling and href references. The advisory states the issue is fixed in PHP 8.2.31, 8.3.31, 8.4.21, and 8.5.6.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-71558**, a heap type confusion flaw in Apache Fory's C++ deserialization logic that affects versions `0.14.0` through versions before `1.5.0`. The vulnerability is triggered by a crafted input payload during polymorphic smart-pointer deserialization, allowing type compatibility checks to be bypassed so an incompatible object can be treated as the declared base type. Apache and downstream advisories warn that successful exploitation can cause undefined behavior and may lead to denial of service or **arbitrary code execution**. The issue is tracked as **CWE-502** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating a network-exploitable flaw with high impact across confidentiality, integrity, and availability. Apache said applications that do not use Fory C++ polymorphic smart-pointer deserialization are not affected, and recommended upgrading to **Apache Fory `1.5.0`**, which fixes the bug. The vulnerability was reported by independent security researcher **Zhixi "Jace" Sun**, while CISA SSVC metadata listed exploitation as none observed, automatable as yes, and technical impact as total.
Aug 7, 2026
A critical remote code execution vulnerability in PHP on Windows, tracked as **`CVE-2024-4577`**, allows argument injection in **PHP-CGI** through Windows Best-Fit character encoding conversion. The flaw affects supported and unsupported PHP 5.x+ versions and is especially dangerous in CGI deployments where `php-cgi.exe` or `php.exe` is exposed to the web, including common default **XAMPP**-style configurations. Researchers reported that specially crafted HTTP requests can bypass prior protections and achieve remote code execution without authentication. Security updates were released in **PHP 8.3.8, 8.2.20, and 8.1.29**, but exploitation began rapidly after disclosure. Multiple reports said attackers were using crafted POST requests to launch `mshta.exe`, retrieve a malicious HTA payload, and execute **TellYouThePass** ransomware via in-memory VBScript loading. Defenders were urged to patch immediately and, where patching was not yet possible, restrict or disable PHP-CGI exposure and apply web-server filtering and configuration mitigations to block exploit requests.
Sep 3, 2026
Apache HTTP Server disclosed **CVE-2026-23918**, a high-severity double-free flaw in `mod_http2` affecting version `2.4.66`, with researchers showing it can be triggered remotely over a single TCP connection by sending crafted HTTP/2 frames on the same stream. The bug stems from the same `h2_stream` object being queued twice for cleanup, causing a second `apr_pool_destroy` on freed memory; on multi-threaded MPM deployments such as **event** and **worker**, this can reliably crash worker processes without authentication, while **prefork** is not affected. Public reporting said denial-of-service is the most practical near-term outcome, but under specific conditions the memory corruption can be developed into pre-authenticated remote code execution. Apache fixed the issue in **version 2.4.67** by preventing duplicate cleanup entries and urged administrators to upgrade immediately. Guidance published alongside the disclosure recommended temporarily disabling **HTTP/2** where patching is delayed, using rate limiting or a WAF to reduce opportunistic abuse, and reviewing exposure from related modules after the same release also patched flaws in `mod_rewrite`, `mod_proxy_ajp`, `mod_md`, and `mod_dav_lock`. At the time of publication, sources said there was **no confirmed in-the-wild exploitation**, but warned that Apache HTTP Server's broad deployment and common `mod_http2` enablement make internet-facing systems attractive targets.
Jun 29, 2026