PHP has recently released maintenance updates to address three significant security vulnerabilities affecting its extensions: ext-pgsql, ext-bcmath, and ext-phar. These flaws could potentially expose web applications to SQL injection attacks, memory corruption, and server crashes. Users are strongly advised to update their PHP installations promptly to mitigate these risks.
Details of the Vulnerabilities
The most critical of these vulnerabilities, identified as CVE-2026-17543, resides in the PostgreSQL extension’s php_pgsql_convert() function. This function is utilized by convenience functions such as pg_insert(), pg_update(), pg_select(), and pg_delete(). The issue arises when user-supplied values are escaped using PQescapeStringConn() and then placed into an escape string constant formatted as E’…’. With PostgreSQL’s standard_conforming_strings setting enabled (the default since version 9.1), backslashes are not safely escaped in this context. An attacker could exploit this flaw to inject SQL commands, potentially accessing or modifying database data. The PHP development team has addressed this issue by using non-escaping string constants when processing these parameters.
The second high-severity vulnerability, CVE-2026-17544, affects the BCMath extension’s bccomp() function. This flaw occurs when an application passes attacker-controlled numeric strings along with a specific scale value. The underlying issue is in the bc_str2num() function, where PHP truncates fractional digits and removes trailing zeroes. The code reduces the allocated buffer size but fails to update the pointer defining the end of the copied fractional data. Consequently, PHP may copy more data than the allocated buffer can hold, leading to an out-of-bounds write that could corrupt stack or heap memory. Depending on the application conditions and the PHP runtime environment, such memory corruption bugs can result in crashes or create avenues for more severe exploitation. The patch updates the fractional endpoint after zero truncation, ensuring that the copied data matches the allocated buffer size.
The third vulnerability, CVE-2026-7260, affects the Phar extension and can cause PHP processes to crash. This issue stems from the phar_get_link_source() function, which recursively follows symbolic links stored in Phar archives without enforcing a recursion depth limit or detecting circular references. A malicious tar-based Phar archive with circular symbolic links could trigger infinite recursion, causing PHP to crash with a segmentation fault and resulting in a moderate-severity denial-of-service (CVSS 6.5). This flaw requires a user or application to process a crafted archive, but it may still disrupt services that automatically inspect, extract, or read uploaded files.
Recommended Actions
Users are urged to upgrade to PHP versions 8.2.33, 8.3.33, 8.4.24, or 8.5.9 to address these vulnerabilities. Additionally, PHP administrators should review applications that rely on PostgreSQL helper functions, BCMath operations with externally supplied values, and file-upload workflows that parse Phar or tar archives.
These updates underscore the importance of regular maintenance and prompt patching in web development. By staying vigilant and applying security updates as they become available, developers can protect their applications from potential exploits and ensure the integrity and reliability of their systems.
