Critical Security Update for PHP: SQL Injection and Denial of Service Vulnerabilities
Summary
ALSA-2026:62614: Important: php security, bug fix, and enhancement update. Affects php versions < 8.3.33-1.el10_2. Fixed in 8.3.33-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is particularly known for its ability to embed HTML and is commonly used with the Apache HTTP Server. The recent vulnerabilities identified in PHP, specifically in versions prior to 8.3.33, expose applications to serious security risks, including SQL injection and denial of service attacks.
Vulnerability Detail
The vulnerabilities stem from improper handling of backslash escaping in the ext-pgsql extension, which can lead to SQL injection (CVE-2026-17543). Additionally, a denial of service vulnerability exists due to circular symbolic links in phar archives (CVE-2026-7260). These vulnerabilities can allow attackers to execute arbitrary SQL commands or crash the application, potentially leading to data breaches or service outages.
How To Fix
Minimum fixed version
8.3.33-1.el10_2
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the PHP application and monitor logs for any suspicious activity until the update is applied. Additionally, disabling the affected extensions may mitigate immediate risks.
Conclusion
The vulnerabilities identified in PHP versions prior to 8.3.33 pose significant risks, including SQL injection and denial of service attacks. It is crucial for users to update their PHP installations to the latest patched version to ensure the security and integrity of their applications.
See every vulnerability recorded for php →
FAQ
SQL injection is a code injection technique that exploits a vulnerability in an application's software by allowing an attacker to interfere with the queries that an application makes to its database.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
A denial of service attack can render your application unavailable to users, leading to loss of revenue, damage to reputation, and potential data loss.
Using an older version of PHP that contains known vulnerabilities is not safe, as it exposes your application to security risks and potential attacks.
If an immediate update is not possible, implement strict access controls, monitor application logs for unusual activity, and consider disabling vulnerable features until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for php.
