Critical Security Flaw in PHP 8.4: SQL Injection and Arbitrary Code Execution Vulnerabilities
Summary
RLSA-2026:56969: Important: php8.4 security, bug fix, and enhancement update. Affects php8.4 versions < 0:8.4.24-1.el10_2. Fixed in 0:8.4.24-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. It allows developers to create dynamic web pages and offers built-in database integration for various database management systems. PHP is often utilized as a replacement for CGI scripts, making it a popular choice for server-side programming. However, vulnerabilities in PHP can lead to severe security risks, including unauthorized access and data breaches.
Vulnerability Detail
The vulnerabilities identified in PHP 8.4 include a SQL injection flaw due to improper backslash escaping (CVE-2026-17543) and an arbitrary code execution risk stemming from an out-of-bounds write in the bccomp() function (CVE-2026-17544). These vulnerabilities can allow attackers to execute malicious SQL queries or run arbitrary code on the server, potentially compromising sensitive data and server integrity.
How To Fix
Minimum fixed version
0:8.4.24-1.el10_2
This is the first release that contains the fix.
sudo dnf update php8.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can mitigate the risk of SQL injection by validating and sanitizing all user inputs before processing them in SQL queries. Additionally, consider disabling the affected functions until the patch is applied.
Conclusion
The vulnerabilities in PHP 8.4 pose significant security risks that can lead to SQL injection and arbitrary code execution. It is essential to update to the patched version 8.4.24 to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your software effectively.
See every vulnerability recorded for php8.4 →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, these vulnerabilities can lead to unauthorized access, data breaches, and arbitrary code execution on the server.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, implement input validation and sanitization as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for php8.4.
