A security vulnerability has been identified in specific versions of PHP, the core programming language that powers most dynamic websites. The flaw impacts PHP 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
The issue is located in PHP's SOAP extension, a tool used for certain types of structured web data exchanges. Sites that do not use SOAP functionality are not at risk from this flaw. For sites that do use SOAP, processing a request with specific duplicate key entries can trigger the vulnerability, leaving a stale reference to memory that has already been freed. An attacker who can send a specially crafted SOAP request to your website could exploit this issue to run unauthorized code on your server, which could allow them to take control of your site or access sensitive data stored on your hosting account.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6722
