Critical Security Update for PHP 8.2: SQL Injection and Denial of Service Vulnerabilities
Summary
ALSA-2026:61903: Important: php:8.2 security, bug fix, and enhancement update. Affects apcu-panel versions < 5.1.23-1.module_el9.4.0+65+49ff6472. Fixed in 5.1.23-1.module_el9.4.0+65+49ff6472. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language that is especially suited for web development. It allows developers to create dynamic web pages and applications by embedding code within HTML. The impacted version, PHP 8.2, is known for its performance improvements and new features. However, it has been found vulnerable to SQL injection and denial of service attacks, which can severely compromise the integrity and availability of applications relying on this version.
Vulnerability Detail
The vulnerabilities stem from improper handling of backslash escaping in the PostgreSQL extension, which can lead to SQL injection attacks (CVE-2026-17543). Additionally, a denial of service vulnerability exists due to circular symbolic links in phar archives (CVE-2026-7260). These vulnerabilities can allow attackers to manipulate database queries or crash applications, leading to unauthorized access or service disruptions.
How To Fix
Minimum fixed version
5.1.23-1.module_el9.4.0+65+49ff6472
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the PostgreSQL extension if it is not critical to your application. This can be done by commenting out the extension in your php.ini file: 'extension=pgsql.so'. However, this is not a permanent solution and updating to the patched version is strongly recommended.
Conclusion
The vulnerabilities identified in PHP 8.2 pose significant risks to applications relying on this version. It is crucial to apply the necessary updates to mitigate these risks and ensure the security and stability of your applications.
See every vulnerability recorded for apcu-panel →
FAQ
CVE-2026-17543 refers to a vulnerability in PHP's PostgreSQL extension that allows for SQL injection due to improper backslash escaping.
CVE-2026-7260 is a vulnerability that can lead to denial of service attacks via circular symbolic links in phar archives.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the affected extensions as a temporary workaround until you can apply the patch.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, ensuring you stay informed about potential threats.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
