Loading story…
Researchers disclosed two vulnerabilities in PHP’s PDO database layer that affect the Firebird and PostgreSQL drivers, showing how low-level driver behavior can bypass application safeguards. The more severe issue, tracked as CVE-2026-25289 in one report and previously referenced as CVE-2025-14179, affects pdo_firebird and can lead to SQL injection when NUL bytes inside quoted input are mishandled during SQL statement reconstruction, potentially dropping a closing quote and allowing attacker-controlled SQL to execute.
A second flaw, CVE-2026-25290 and previously referenced as CVE-2025-14180, affects PDO quoting with pdo_pgsql when emulated prepared statements are enabled. Invalid multibyte input can cause PostgreSQL escaping to return NULL, which PDO then dereferences, crashing PHP processes and creating a denial-of-service condition. The bugs were identified by PT SWARM researchers Aleksey Solovev and Nikita Sveshnikov, and patched PHP releases are available; organizations running older versions are exposed until they upgrade and should avoid unnecessary emulated prepares where possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
PHP released fixes for the two PDO driver vulnerabilities affecting Firebird and PostgreSQL. The patched releases address the SQL injection issue in pdo_firebird and the NULL dereference crash issue in pdo_pgsql.
PT SWARM researchers Aleksey Solovev and Nikita Sveshnikov identified a SQL injection flaw in pdo_firebird and a denial-of-service flaw in pdo_pgsql during an audit of PDO and its dependent client libraries.
On 2026-07-07, Cyber Security News reported the newly disclosed vulnerabilities affecting PHP's PDO Firebird and PostgreSQL drivers, highlighting the risks to unpatched deployments and summarizing the released fixes.
On 2026-07-06, Positive Technologies published PT SWARM's technical analysis detailing the pdo_firebird NUL-byte SQL injection issue and the pdo_pgsql NULL pointer dereference issue, along with exploitation mechanics and mitigation guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceswarm.ptsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PHP disclosed fixes for two high-severity vulnerabilities affecting multiple supported branches. `CVE-2026-17543` is an SQL injection flaw in `ext-pgsql` caused by improper escaping of backslashes in attacker-controlled parameters, enabling trivial injection through `E'...'` breakout. `CVE-2026-17544` is an out-of-bounds write in `ext-bcmath` where crafted input to `bccomp()` can trigger stack and heap corruption. Both issues are rated as network-exploitable with low attack complexity and high impact on confidentiality, integrity, and availability, and CISA SSVC metadata indicates no exploitation has been observed but both flaws are considered automatable with total technical impact. The vulnerabilities affect PHP versions before `8.2.33`, `8.3.33`, `8.4.24`, and `8.5.9`, with the `bccomp()` flaw applying to `8.4.x` and `8.5.x` before those patched releases. The Canadian Centre for Cyber Security published advisory `AV26-764`, echoing the PHP Group notice and urging users and administrators to review the vendor guidance and update affected deployments as fixes become available.
Jul 31, 2026
Firebird disclosed two high-severity vulnerabilities affecting versions prior to `5.0.4`, `4.0.7`, and `3.0.14`, including a path traversal and arbitrary file write issue tracked as `CVE-2026-40342`. The flaw resides in the external engine plugin loader, which improperly concatenates a user-controlled engine name into a filesystem path without filtering path separators or `..` sequences. An authenticated user with `CREATE FUNCTION` privileges can abuse the bug to load an arbitrary shared library from disk, causing its initialization code to run immediately under the Firebird server's operating system account and resulting in remote code execution. A second vulnerability, `CVE-2026-28224`, allows an unauthenticated attacker to crash a Firebird server by sending an `op_crypt_key_callback` packet before authentication, triggering a null pointer dereference because the `port_server_crypt_callback` handler is not initialized. The denial-of-service condition requires only network access to the server's IP address and port. Firebird addressed both issues in releases `5.0.4`, `4.0.7`, and `3.0.14`, with advisories indicating the bugs carry high impact across availability and, in the case of `CVE-2026-40342`, confidentiality and integrity as well.
Jun 29, 2026
PostgreSQL released security updates for supported branches to fix multiple high-severity vulnerabilities affecting versions before **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**. The most serious issues include **CVE-2026-6473**, an integer wraparound bug that can cause undersized allocations and out-of-bounds writes, and **CVE-2026-6637**, a flaw in the `refint` module that can lead to a stack buffer overflow. In both cases, an unprivileged database user may be able to achieve arbitrary code execution as the operating system account running PostgreSQL. The `refint` issue also exposes a separate SQL injection path when applications use a user-controlled column as a `refint` cascade primary key and allow user-controlled updates, potentially enabling arbitrary SQL execution as the database user performing the update. Debian issued security advisories for **postgresql-15** and **postgresql-17**, and the Canadian Centre for Cyber Security urged administrators to review PostgreSQL’s advisory and deploy the patched releases **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**.
Jun 29, 2026