Critical Security Update for PHP 8.4: SQL Injection and Code Execution Vulnerabilities
Summary
ALSA-2026:56969: Important: php8.4 security, bug fix, and enhancement update. Affects php8.4 versions < 8.4.24-1.el10_2. Fixed in 8.4.24-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It allows developers to create dynamic web pages and offers built-in database integration for various database management systems. PHP is commonly used as a replacement for CGI scripts, making it a popular choice for web applications. However, vulnerabilities in PHP can lead to severe security risks, including SQL injection and arbitrary code execution, which can compromise the integrity and security of web applications.
Vulnerability Detail
The vulnerabilities identified in PHP 8.4 include a SQL injection flaw due to improper backslash escaping in the ext-pgsql extension (CVE-2026-17543) and an arbitrary code execution vulnerability caused by an out-of-bounds write in the bccomp() function (CVE-2026-17544). These vulnerabilities can allow attackers to execute malicious SQL queries or run arbitrary code on the server, potentially leading to data breaches or complete system compromise.
How To Fix
Minimum fixed version
8.4.24-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating is not immediately possible, consider implementing input validation and sanitization to mitigate the risk of SQL injection. Additionally, restrict access to sensitive functions and monitor logs for any suspicious activity.
Conclusion
The vulnerabilities in PHP 8.4 pose significant risks to web applications, including SQL injection and arbitrary code execution. It is crucial to update to the patched version 8.4.24-1.el10_2 to mitigate these risks. Implementing workarounds can provide temporary relief, but timely updates are essential for maintaining security.
See every vulnerability recorded for php8.4 →
FAQ
CVE-2026-17543 is a vulnerability in PHP that allows SQL injection due to improper backslash escaping in the ext-pgsql extension.
CVE-2026-17544 is a vulnerability in PHP that enables arbitrary code execution through an out-of-bounds write in the bccomp() function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not feasible, implement input validation and sanitization, and monitor your application for suspicious activity as a temporary workaround.
Failing to address these vulnerabilities can lead to SQL injection attacks, unauthorized access, data breaches, and arbitrary code execution, compromising the security of your web applications.
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
