REDHAT-BUG-2509254: SQL Injection

Q: Which PHP releases need to be updated?

Affected releases are PHP 8.2 before 8.2.33, PHP 8.3 before 8.3.33, PHP 8.4 before 8.4.24, and PHP 8.5 before 8.5.9. Update to the applicable listed release or later.

Q: What attacker input is required to exploit this issue?

An attacker must be able to supply parameters that reach the vulnerable PHP handling. Improper escaping of backslashes in those parameters can enable SQL injection.

Published Jul 30, 2026

Updated

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.

Affected Software

1 affected component

PHP PHP>8.2.0<8.2.33, >8.3.0<8.3.33, >8.4.0<8.4.24, >8.5.0<8.5.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.2.33
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.3.33
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.4.24
Upgrade
Upgrade PHP to a version that resolves this vulnerability.
Fixed in 8.5.9

Event History

Jul 30, 2026

Data Sourced

via Red Hat·12:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which PHP releases need to be updated?

Affected releases are PHP 8.2 before 8.2.33, PHP 8.3 before 8.3.33, PHP 8.4 before 8.4.24, and PHP 8.5 before 8.5.9. Update to the applicable listed release or later.

What attacker input is required to exploit this issue?