A security flaw has been identified in specific older versions of PHP, the core software that powers most dynamic, feature-rich websites. The affected versions are PHP 8.2 releases older than 8.2.31, 8.3 older than 8.3.31, 8.4 older than 8.4.21, and 8.5 older than 8.5.6. The issue only affects sites that use PHP’s SOAP web service tooling configured to save session data across user requests, a setup used for certain integrations with external services. If a SOAP request made via this tooling fails, the system mishandles the saved session data, leaving a reference to information that has already been cleared from memory.
This flaw can cause serious problems for affected sites, including unexpected crashes that make your site unavailable to visitors, unauthorized access to sensitive data stored on your site (such as customer information), or corruption of site content and user data. It impacts the core safety and reliability of any site running the affected PHP versions with this specific configuration, putting both your site's functionality and your visitors' private information at risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
