A security flaw has been identified in certain recent versions of PHP, the code that powers many dynamic websites. The issue is triggered when a hidden special character (called a NUL byte) is included in a text encoding name passed to common PHP text processing tools. Due to a coding error, PHP miscalculates the length of these inputs, which can cause the server to read parts of its own memory that it is not supposed to access.
This flaw could cause your website to crash without warning, or in rare cases allow unauthorized users to access small amounts of sensitive server information. It impacts PHP versions 8.4.x older than 8.4.21 and 8.5.x older than 8.5.6.
The affected tools include standard functions used for converting text between different character sets, detecting what character set content uses, and related server settings that control how character sets are handled on your site.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
