Fixed (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.

ext/openssl: Memory corruption in opensslencrypt with AES-WRAP-PAD

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9.

Fixed bug (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)

Fixed bug (Buffer underflow in bcshiftaddsub). (CVE-2019-11046)

A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference: https://bugs.php.net/bug.php?id=78863

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Fixed bug (mail() may release string with refcount==1 twice). (CVE-2019-11049)

Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)

Buffer overflow and overread in phardirread()

Configuring a proxy in a stream context might allow for CRLF injection in URIs

Fixed bug (OOB access in ldapescape). (CVE-2024-8932)

Fixed bug (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)

Fixed bug (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)

Fixed bug GHSA-h746-cjrr-wfmr (passwordverify can erroneously return true, opening ATO risk). (CVE-2024-3096)

Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix

Fixed bug GHSA-fjp9-9hwx-59fq (mbencodemimeheader runs endlessly for some inputs). (CVE-2024-2757)

Command injection via array-ish $command parameter of procopen()

CVE-2023-0567[0]: PHP: Passwordverify() always return true with some hash

[0] https://security-tracker.debian.org/tracker/CVE-2023-0567 https://www.cve.org/CVERecord?id=CVE-2023-0567 https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9.

The parsestr function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin.

Upgrade libgd. (CVE-2026-9672)

Fixed (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)

Fixed (Use-after-free after header parsing failure with SOAPPERSISTENCESESSION). (CVE-2026-7261)

Fixed (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)

Fixed (Broken Apache map value NULL check). (CVE-2026-7262)

Fixed (XSS within status endpoint). (CVE-2026-6735)

Fixed (Stale SOAPGLOBAL(refmap) pointer with Apache Map). (CVE-2026-6722)