Loading story…
The Perl DBI project released a series of updates that fixed multiple security flaws across DBI and related components including DBI::SQL::Nano, DBD::File, and DBI::ProfileData. The changelog for versions 1.648, 1.650, and 1.651 lists fixes for CVE-2026-9698, CVE-2026-10879, CVE-2026-14380, CVE-2026-14739, CVE-2026-14740, CVE-2026-15043, CVE-2026-15392, CVE-2026-60081, and CVE-2026-60082, reflecting a broad hardening effort across the database interface stack.
The patched issues include code injection, out-of-bounds reads, buffer and stack overflows, path traversal or symlink problems, and limits around placeholder parsing. One of the referenced weakness classes is CWE-134, Use of Externally-Controlled Format String, underscoring the memory-safety and input-handling risks addressed in the releases. Organizations using Perl applications that depend on DBI or its file- and SQL-related modules should prioritize upgrading to the latest fixed versions and review exposed components for unsafe input handling and file access patterns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The changelog reports that DBI version 1.651 fixed CVE-2026-15043, CVE-2026-15392, CVE-2026-60082, and CVE-2026-60081. These fixes covered vulnerabilities including issues in DBI and related components such as DBI::SQL::Nano, DBD::File, and DBI::ProfileData.
According to the changelog, DBI version 1.650 fixed CVE-2026-14739, CVE-2026-14740, and CVE-2026-14380. The synopsis indicates this release occurred during June and July 2026.
The DBI project changelog states that version 1.648 fixed CVE-2026-9698 and CVE-2026-10879 as part of security hardening work across the codebase. The synopsis places this release in June 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PHP disclosed fixes for two high-severity vulnerabilities affecting multiple supported branches. `CVE-2026-17543` is an SQL injection flaw in `ext-pgsql` caused by improper escaping of backslashes in attacker-controlled parameters, enabling trivial injection through `E'...'` breakout. `CVE-2026-17544` is an out-of-bounds write in `ext-bcmath` where crafted input to `bccomp()` can trigger stack and heap corruption. Both issues are rated as network-exploitable with low attack complexity and high impact on confidentiality, integrity, and availability, and CISA SSVC metadata indicates no exploitation has been observed but both flaws are considered automatable with total technical impact. The vulnerabilities affect PHP versions before `8.2.33`, `8.3.33`, `8.4.24`, and `8.5.9`, with the `bccomp()` flaw applying to `8.4.x` and `8.5.x` before those patched releases. The Canadian Centre for Cyber Security published advisory `AV26-764`, echoing the PHP Group notice and urging users and administrators to review the vendor guidance and update affected deployments as fixes become available.
Jul 31, 2026
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026
Researchers disclosed two vulnerabilities in PHP’s PDO database layer that affect the Firebird and PostgreSQL drivers, showing how low-level driver behavior can bypass application safeguards. The more severe issue, tracked as **`CVE-2026-25289`** in one report and previously referenced as **`CVE-2025-14179`**, affects `pdo_firebird` and can lead to SQL injection when NUL bytes inside quoted input are mishandled during SQL statement reconstruction, potentially dropping a closing quote and allowing attacker-controlled SQL to execute. A second flaw, **`CVE-2026-25290`** and previously referenced as **`CVE-2025-14180`**, affects PDO quoting with `pdo_pgsql` when emulated prepared statements are enabled. Invalid multibyte input can cause PostgreSQL escaping to return `NULL`, which PDO then dereferences, crashing PHP processes and creating a denial-of-service condition. The bugs were identified by PT SWARM researchers Aleksey Solovev and Nikita Sveshnikov, and patched PHP releases are available; organizations running older versions are exposed until they upgrade and should avoid unnecessary emulated prepares where possible.
Jul 7, 2026