A security flaw has been found in specific versions of PHP, a programming language widely used to power dynamic website functionality. The issue is caused by improper escaping of backslash characters in data submitted by visitors to your site. This flaw makes SQL injection attacks extremely easy for attackers to carry out. In simple terms, this means a bad actor could trick your website’s database into accessing, modifying, or deleting private stored information without permission, such as customer personal details, account credentials, or your site’s published content. The affected PHP versions are all 8.2 releases older than 8.2.33, all 8.3 releases older than 8.3.33, all 8.4 releases older than 8.4.24, and all 8.5 releases older than 8.5.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-17543
