A security flaw has been found in specific recent versions of PHP, the software that powers most websites. The issue exists in the bccomp() function, a built-in PHP tool used to compare decimal numbers for tasks like handling pricing, financial calculations, or user-submitted numeric input. When an attacker sends specially crafted input to this function, it can cause the system to write data to the wrong area of memory, leading to corruption of the site's core operating memory.
Only PHP 8.4.* versions older than 8.4.24, and PHP 8.5.* versions older than 8.5.9 are impacted by this vulnerability. If your site runs one of these unpatched PHP versions, this flaw could be exploited to interrupt your site's normal function, give unauthorized users access to your site's data or admin controls, or let attackers make unwanted changes to your site's content or settings.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-17544
