Critical Security Update for PHP 8.3: SQL Injection and Denial of Service Vulnerabilities
Summary
ALSA-2026:57539: Important: php:8.3 security, bug fix, and enhancement update. Affects apcu-panel versions < 5.1.23-1.module_el9.6.0+151+5f31e576. Fixed in 5.1.23-1.module_el9.6.0+151+5f31e576. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is particularly known for its ability to embed HTML and interact with databases. The recent vulnerabilities in PHP 8.3 could lead to severe security issues, including SQL injection and denial of service attacks, affecting applications that rely on this version.
Vulnerability Detail
The vulnerabilities identified in PHP 8.3 include a SQL injection flaw due to improper backslash escaping in the ext-pgsql extension (CVE-2026-17543) and a denial of service vulnerability caused by circular symbolic links in phar archives (CVE-2026-7260). These vulnerabilities can allow attackers to manipulate database queries and potentially crash the application, leading to service disruptions.
How To Fix
Minimum fixed version
5.1.23-1.module_el9.6.0+151+5f31e576
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the affected extensions or limit the permissions of the PHP application to reduce exposure to these vulnerabilities. However, this is not a permanent solution, and updating to the patched version is strongly recommended.
Conclusion
The vulnerabilities in PHP 8.3 pose significant risks to applications using this version. It is crucial to update to the latest patched version to mitigate these risks and ensure the security of your web applications.
See every vulnerability recorded for apcu-panel →
FAQ
CVE-2026-17543 refers to a SQL injection vulnerability in PHP's ext-pgsql extension that can allow attackers to manipulate database queries.
CVE-2026-7260 is a denial of service vulnerability in PHP that can be exploited through circular symbolic links in phar archives.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling the affected extensions or restricting permissions as a temporary measure.
For more details, refer to the CVE pages listed in the references section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
