A security flaw, tracked as CVE-2026-7261, has been found in specific older versions of PHP, the software that powers many websites. The issue only impacts sites that use PHP's SOAP feature (a tool for connecting different web services to each other) and have that feature set to save user session data across requests. The affected PHP versions are 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6. When a SOAP request returns an error on these versions, a glitch in the error handling process causes the software to delete a saved data object while still keeping a reference to it. This can lead to unexpected website crashes, leaked sensitive site or user information, or corrupted data on the affected server, impacting the security and reliability of the system running the vulnerable PHP version.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
