PHP fixes 3 critical vulnerabilities

Article by Nacata Security, 31/07/2026

Does your web application talk to a database or process files uploaded by users?

PHP has patched three vulnerabilities that put exactly that at risk.

The affected extensions — ext-pgsql, ext-bcmath, and ext-phar — are optional components but are very common in real-world applications that process external data or manage compressed files.

The problem lay in auxiliary components that almost no one monitors, and which could open the door to serious attacks against data and availability.

The most severe flaw targets your database directly.

CVE-2026-17543 affects the PostgreSQL extension. The function php_pgsql_convert() escapes user values and places them in a special string format. With PostgreSQL’s default configuration since version 9.1, backslashes are not neutralized. An attacker who controls the input data can inject SQL commands and access or modify the database without authorization.

The second flaw corrupts server memory.

CVE-2026-17544 resides in the BCMath extension, in the bccomp() function. When the application passes attacker-controlled numeric strings with a specific scale value, the code trims decimals and removes trailing zeros but does not update the pointer that delimits how far to copy. PHP writes beyond the reserved memory space, corrupting the stack or heap and opening the door to crashes or serious exploitation.

The third flaw takes down the entire server with a single booby-trapped file.

CVE-2026-7260 affects the Phar extension. The function phar_get_link_source() follows symbolic links with no depth limit or loop detection. A tar-based Phar file with circular references triggers infinite recursion: the PHP process crashes with a segmentation fault and the service goes offline.

The patch already exists: it just needs to be applied.

PHP has released fixed versions for all active branches. The fix is available and the path is clear, but every day without updating is a day these three attack vectors remain open in production.

There are additional layers of risk to consider.

The memory corruption flaw in BCMath is particularly concerning because it depends on the PHP runtime environment. In some contexts it causes only a crash, but in others it opens a sophisticated exploitation path. Applications that perform financial or scientific calculations with external data are the most exposed, and many are unaware that they are using bccomp() in a vulnerable way.

The Phar flaw is triggered without user interaction.

Many applications inspect or extract uploaded files automatically, without direct human intervention. A malicious Phar file can slip into that workflow and bring down the PHP process without anyone having clicked a single button. This makes it a silent vector for denial-of-service attacks.

The fixed versions cover four active PHP branches.

PHP has released versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9. If your environment is running any earlier version on any of those branches, all three flaws are still present, exploitable right now, and without any documented alternative mitigation.

Updating is the only real solution.

There is no documented alternative mitigation for all three flaws simultaneously. Manually reviewing code that uses pg_insert(), pg_update(), bccomp(), or that processes Phar files can help with prioritization, but it is not a substitute for the patch. The attack surface is too broad to manage with rules or external filters alone.

Every hour without patching has consequences.

If your application touches PostgreSQL, performs calculations with BCMath, or processes compressed files uploaded by users, you have urgent work to do today.

Do you know exactly which version of PHP is running in your production environment today?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime