Critical Security Vulnerability in PHP: Memory Corruption and SQL Injection Risks
Summary
RLSA-2026:61259: Low: php security, bug fix, and enhancement update. Affects php versions < 0:8.0.30-8.el9_8. Fixed in 0:8.0.30-8.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language widely utilized for web development, particularly in conjunction with the Apache HTTP Server. It allows developers to create dynamic web pages and applications efficiently. However, recent vulnerabilities have been identified that could compromise the security of applications relying on PHP, particularly versions prior to 8.0.30.
Vulnerability Detail
The vulnerabilities identified in PHP include memory corruption in the openssl_encrypt function due to improper handling of AES-WRAP-PAD (CVE-2026-14355), SQL injection risks stemming from improper backslash escaping in the ext-pgsql module (CVE-2026-17543), and a Denial of Service vulnerability caused by circular symbolic links in phar archives (CVE-2026-7260). These vulnerabilities can lead to unauthorized access, data manipulation, and service disruptions, making it imperative for users to address them promptly.
How To Fix
Minimum fixed version
0:8.0.30-8.el9_8
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement input validation and sanitization to mitigate the risk of SQL injection and avoid using vulnerable functions until the update is applied. However, this is not a substitute for applying the official patch.
Conclusion
The identified vulnerabilities in PHP pose serious risks to applications, including memory corruption, SQL injection, and Denial of Service. It is crucial for users to update to the latest patched version to safeguard their systems and data. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for php →
FAQ
CVE-2026-14355 refers to a memory corruption vulnerability in the openssl_encrypt function of PHP, which could lead to potential exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can receive real-time alerts about vulnerabilities.
CVE-2026-17543 is a SQL injection vulnerability that can allow attackers to manipulate database queries, potentially leading to unauthorized data access or corruption.
A CVSS score of 7.4 indicates a high severity level, suggesting that the vulnerability poses a significant risk to systems and should be addressed urgently.
Yes, Vulert allows you to monitor vulnerabilities using just a manifest file like package-lock.json, without requiring any coding or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
