PHP is the core software that powers most dynamic websites and web applications, including content management systems, e-commerce stores, and custom web tools. A security flaw has been identified in specific, unpatched versions of PHP: 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
The bug exists in PHP's SOAP extension, a tool used to handle certain types of data requests between different systems. When processing SOAP request data that contains duplicate entries, the bug leaves behind a stale reference to memory that has already been freed. If an attacker can send a specially crafted SOAP request to a site running an affected PHP version, they can exploit this flaw to run unauthorized code on the server.
This type of vulnerability, called remote code execution, could allow an attacker to access your website files and databases, modify or delete your site content, or use your hosting account for malicious activity such as sending spam or hosting harmful files.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6722
