A security flaw impacts specific versions of PHP, the core software that runs most websites. The affected versions are PHP 8.4 releases older than 8.4.21, and PHP 8.5 releases older than 8.5.6. The flaw is triggered when specially crafted input containing a hidden null byte is sent to PHP's built-in text encoding tools, which handle converting and detecting character sets for content like multilingual text on your site. Due to a coding error, this can cause the software to read small amounts of data from the server's memory that it should not have access to, which may lead to unexpected site crashes or, in rare cases, the exposure of small amounts of sensitive information. The vulnerable components include the mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order() functions, as well as related settings that control how PHP handles encoded text output and character set detection.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
