Loading story…
PHP disclosed fixes for two high-severity vulnerabilities affecting multiple supported branches. CVE-2026-17543 is an SQL injection flaw in ext-pgsql caused by improper escaping of backslashes in attacker-controlled parameters, enabling trivial injection through E'...' breakout. CVE-2026-17544 is an out-of-bounds write in ext-bcmath where crafted input to bccomp() can trigger stack and heap corruption. Both issues are rated as network-exploitable with low attack complexity and high impact on confidentiality, integrity, and availability, and CISA SSVC metadata indicates no exploitation has been observed but both flaws are considered automatable with total technical impact.
The vulnerabilities affect PHP versions before 8.2.33, 8.3.33, 8.4.24, and 8.5.9, with the bccomp() flaw applying to 8.4.x and 8.5.x before those patched releases. The Canadian Centre for Cyber Security published advisory AV26-764, echoing the PHP Group notice and urging users and administrators to review the vendor guidance and update affected deployments as fixes become available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On July 30, 2026, PHP announced four security releases: versions 8.5.9, 8.4.24, 8.3.33, and 8.2.33. The releases fixed multiple issues including CVE-2026-17543, CVE-2026-17544, CVE-2026-7260, and CVE-2026-9672.
On July 30, 2026, the Canadian Centre for Cyber Security published advisory AV26-764 warning that multiple PHP branches prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9 are affected by the ext-pgsql SQL injection flaw and the bccomp() out-of-bounds write. The advisory urged users and administrators to review the referenced links and apply updates as they become available.
A vulnerability in PHP's ext-bcmath package was disclosed in which attacker-controlled input to bccomp() can trigger an out-of-bounds write leading to stack and heap corruption. The issue affects PHP 8.4.x before 8.4.24 and 8.5.x before 8.5.9.
A SQL injection flaw in PHP's ext-pgsql package was disclosed, caused by improper escaping of backslashes in attacker-provided parameters that can enable trivial SQL injection. Affected versions include PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceseclists.org
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two vulnerabilities in PHP’s PDO database layer that affect the Firebird and PostgreSQL drivers, showing how low-level driver behavior can bypass application safeguards. The more severe issue, tracked as **`CVE-2026-25289`** in one report and previously referenced as **`CVE-2025-14179`**, affects `pdo_firebird` and can lead to SQL injection when NUL bytes inside quoted input are mishandled during SQL statement reconstruction, potentially dropping a closing quote and allowing attacker-controlled SQL to execute. A second flaw, **`CVE-2026-25290`** and previously referenced as **`CVE-2025-14180`**, affects PDO quoting with `pdo_pgsql` when emulated prepared statements are enabled. Invalid multibyte input can cause PostgreSQL escaping to return `NULL`, which PDO then dereferences, crashing PHP processes and creating a denial-of-service condition. The bugs were identified by PT SWARM researchers Aleksey Solovev and Nikita Sveshnikov, and patched PHP releases are available; organizations running older versions are exposed until they upgrade and should avoid unnecessary emulated prepares where possible.
Jul 7, 2026
PHP has patched two memory-safety vulnerabilities in its `ext/standard` image-handling code that can be triggered by specially crafted JPEG input. One issue, tracked as **CVE-2025-14177**, affects `getimagesize` and can disclose uninitialized heap memory when JPEG APP segments are read across multiple chunks, potentially exposing server-side data through returned metadata such as `APP1`. A second flaw in `iptcembed` can cause a heap buffer overflow and denial of service because the function sizes its output buffer from a single `fstat()` result and then continues copying data until EOF, creating risk when processing FIFOs, pipes, sockets, or files that grow after the initial size check. The bugs were discovered by Positive Technologies researcher Nikita Sveshnikov, who published proof-of-concept demonstrations showing both filter-based and direct exploitation paths for `getimagesize`, as well as a FIFO-based overflow scenario for `iptcembed`. PHP addressed the flaws by correcting chunk-buffer pointer handling in `php_read_stream_all_chunks` and adding boundary checks and safer error handling for `iptcembed`; fixes were released in **PHP 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1**. The most exposed deployments include public upload endpoints, CMS thumbnailing workflows, webmail platforms, and image CDNs that inspect user-supplied images on the server side.
Jun 29, 2026
PostgreSQL released security updates for supported branches to fix multiple high-severity vulnerabilities affecting versions before **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**. The most serious issues include **CVE-2026-6473**, an integer wraparound bug that can cause undersized allocations and out-of-bounds writes, and **CVE-2026-6637**, a flaw in the `refint` module that can lead to a stack buffer overflow. In both cases, an unprivileged database user may be able to achieve arbitrary code execution as the operating system account running PostgreSQL. The `refint` issue also exposes a separate SQL injection path when applications use a user-controlled column as a `refint` cascade primary key and allow user-controlled updates, potentially enabling arbitrary SQL execution as the database user performing the update. Debian issued security advisories for **postgresql-15** and **postgresql-17**, and the Canadian Centre for Cyber Security urged administrators to review PostgreSQL’s advisory and deploy the patched releases **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**.
Jun 29, 2026