Loading story…
CakePHP disclosed and patched CVE-2026-77635, a SQL injection flaw in FunctionsBuilder::jsonValue() when used with the PostgreSQL driver. The weakness allowed query manipulation if attacker-controlled input was passed to the jsonPath parameter, affecting CakePHP and cakephp/database versions >= 5.1.0, < 5.1.10, >= 5.2.0, < 5.2.15, and >= 5.3.0, < 5.3.7. The issue is tracked as CWE-89 and carries a CVSS v4 assessment indicating network exploitability, low attack complexity, no privileges required, and high confidentiality and integrity impact.
Maintainers released fixes across supported branches in commits for the 5.2.x, 5.3.x, and 5.x lines, changing how PostgreSQL-specific jsonValue expressions are transformed. Regression tests added with the patches show legitimate JSON path extraction still works, while malicious path payloads now fail with a PostgreSQL syntax error surfaced as a QueryException instead of enabling successful query manipulation. The fix was credited to reporter Himanshu Anand, and patched releases include 5.1.10, 5.2.15, and 5.3.7.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
CERT-PY reported CVE-2026-77634, a header injection vulnerability in CakePHP that could let attackers inject additional code into an email header via user-controlled data. The notice says versions before 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 are affected and recommends upgrading to fixed releases.
A CVE entry recorded the issue as CVE-2026-77635, describing an SQL injection vulnerability in CakePHP and cakephp/database when user-controlled data is passed to jsonPath with PostgresDriver. The record also states GitHub published advisory GHSA-fxf7-vhh8-7vpq and lists affected and fixed version ranges.
On July 16, 2026, CakePHP also committed the PostgreSQL jsonValue fix to its 5.2.x branch, associated with version 5.2.15. The change removed unsafe handling of user-controlled JSON path expressions and added a regression test for malicious payloads.
On July 16, 2026, CakePHP committed the same PostgreSQL jsonValue fix to its 5.1.x branch, associated with release 5.1.10. The regression test verified benign JSON path extraction still worked while malicious input now triggered a QueryException instead of enabling query manipulation.
On July 9, 2026, CakePHP committed a fix for a query-manipulation weakness in FunctionsBuilder::jsonValue() for the PostgreSQL driver. The patch changed PostgreSQL JSON value transformation logic, added a regression test, and credited Himanshu Anand for reporting the issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two vulnerabilities in PHP’s PDO database layer that affect the Firebird and PostgreSQL drivers, showing how low-level driver behavior can bypass application safeguards. The more severe issue, tracked as **`CVE-2026-25289`** in one report and previously referenced as **`CVE-2025-14179`**, affects `pdo_firebird` and can lead to SQL injection when NUL bytes inside quoted input are mishandled during SQL statement reconstruction, potentially dropping a closing quote and allowing attacker-controlled SQL to execute. A second flaw, **`CVE-2026-25290`** and previously referenced as **`CVE-2025-14180`**, affects PDO quoting with `pdo_pgsql` when emulated prepared statements are enabled. Invalid multibyte input can cause PostgreSQL escaping to return `NULL`, which PDO then dereferences, crashing PHP processes and creating a denial-of-service condition. The bugs were identified by PT SWARM researchers Aleksey Solovev and Nikita Sveshnikov, and patched PHP releases are available; organizations running older versions are exposed until they upgrade and should avoid unnecessary emulated prepares where possible.
Jul 7, 2026
PHP disclosed fixes for two high-severity vulnerabilities affecting multiple supported branches. `CVE-2026-17543` is an SQL injection flaw in `ext-pgsql` caused by improper escaping of backslashes in attacker-controlled parameters, enabling trivial injection through `E'...'` breakout. `CVE-2026-17544` is an out-of-bounds write in `ext-bcmath` where crafted input to `bccomp()` can trigger stack and heap corruption. Both issues are rated as network-exploitable with low attack complexity and high impact on confidentiality, integrity, and availability, and CISA SSVC metadata indicates no exploitation has been observed but both flaws are considered automatable with total technical impact. The vulnerabilities affect PHP versions before `8.2.33`, `8.3.33`, `8.4.24`, and `8.5.9`, with the `bccomp()` flaw applying to `8.4.x` and `8.5.x` before those patched releases. The Canadian Centre for Cyber Security published advisory `AV26-764`, echoing the PHP Group notice and urging users and administrators to review the vendor guidance and update affected deployments as fixes become available.
Jul 31, 2026
Drupal released security updates for **CVE-2026-9082**, a highly critical SQL injection flaw in Drupal core that affects websites using **PostgreSQL** databases. The vulnerability stems from improper neutralization of special characters in user input within Drupal's database API, allowing an unauthenticated remote attacker to send crafted requests that can trigger SQL injection. Successful exploitation could lead to **information disclosure**, **privilege escalation**, and in some environments potentially **remote code execution**. Drupal and downstream defenders urged administrators to upgrade to fixed versions **10.4.10**, **10.5.10**, **10.6.9**, **11.1.10**, **11.2.12**, or **11.3.10**, while manual patches were also issued for unsupported **8.9** and **9.5** branches; the flaw's severity was raised to **CVSS 9.8** after initial scoring understated the risk.
Jul 24, 2026