A security issue has been found in specific older versions of the PHP software that powers most websites: all 8.2 versions older than 8.2.31, all 8.3 versions older than 8.3.31, all 8.4 versions older than 8.4.21, and all 8.5 versions older than 8.5.6.
The flaw only affects sites that use the SoapServer feature for handling web service requests, with session persistence turned on for these requests. When a SOAP request on an affected site returns an error, the system incorrectly handles the session-stored data for this feature: it frees up the related object but keeps a reference to it, which can trigger a memory management error.
This type of error can lead to unexpected site crashes, leak sensitive information stored on your server, or corrupt your site’s data. These outcomes could disrupt visitor access to your site and compromise the confidentiality, integrity, and availability of your site and the information it handles.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
