A security vulnerability has been found in specific versions of PHP, the common programming language that powers many dynamic websites. The flaw is caused by improper handling of backslashes in data submitted by site visitors, such as form entries or information passed in page URLs.
This issue can be exploited to carry out SQL injection attacks, which let unauthorized users run malicious commands on your website’s database. If successful, these attacks could allow bad actors to access, alter, or delete your site’s stored data, including customer information, user accounts, or core site content.
The affected PHP versions are all 8.2 releases older than 8.2.33, all 8.3 releases older than 8.3.33, all 8.4 releases older than 8.4.24, and all 8.5 releases older than 8.5.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-17543
