Do Son 
TL;DR
The PHP project fixed three flaws in its latest releases. The headline bug is a PHP SQL injection flaw, CVE-2026-17543, in the PostgreSQL extension. Two memory-safety bugs round out the set. All carry patches in PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9.
- Product: PHP Group PHP
- Vulnerabilities: 3 flaws (CVE-2026-17543, CVE-2026-17544, CVE-2026-7260)
- Highest severity: 8.1 (High · CVSSv4)
- Worst impact: SQL injection in ext-pgsql via E'...' backslash breakout
- Status: No confirmed exploitation yet; patches available
- Action: Update to 8.2.33, 8.3.33, 8.4.24, 8.5.9 now
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-17543 | 8.1 | SQL injection in ext-pgsql via E'...' backslash breakout | 8.2.33, 8.3.33, 8.4.24 (+1) | Not exploited |
| CVE-2026-17544 | 8.1 | Out-of-bounds write in bccomp() via crafted operand and scale | 8.4.24, 8.5.9 | Not exploited |
| CVE-2026-7260 | 5.4 | Stack overflow in phar with circular symlinks | 8.2.33, 8.3.33, 8.4.24 (+1) | Not exploited |
Why it matters
PHP powers a huge share of the web. So a database flaw in a core extension has wide reach. An attacker could read or alter data that should stay protected.
The two memory bugs raise the stakes further. Both can corrupt process memory, which may cause crashes or worse.
How the attacks work
PostgreSQL SQL injection
CVE-2026-17543 scores 8.1. It affects pg_insert, pg_update, pg_select, and pg_delete in the pgsql extension. Under the default PostgreSQL setting, the escape routine fails to handle a backslash. As a result, an attacker can break out of the string and inject their own query. The PHP advisory details the fix.
Two memory bugs
CVE-2026-17544 is an out-of-bounds write in BCMath, also rated 8.1. A crafted value passed to bccomp can corrupt stack or heap memory, as the BCMath advisory explains. Separately, CVE-2026-7260 lets a booby-trapped phar archive crash PHP through circular symlinks. The phar advisory covers that denial-of-service bug.
Affected versions
The SQL injection and phar bugs affect PHP before 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The BCMath write hits only the 8.4 and 8.5 branches. No in-the-wild exploitation has been confirmed.
Patch and mitigation
Update PHP now to a patched build. For the database risk, prefer parameterized queries over raw input. That habit blocks this PHP SQL injection class even beyond this fix. Also verify GPG signatures before you deploy.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
