A security flaw has been identified in specific recent versions of PHP, the core software that powers most dynamic websites. The issue impacts PHP 8.4 releases older than 8.4.21, and PHP 8.5 releases older than 8.5.6. It is triggered when a specially crafted encoding name containing a hidden null byte is passed to a set of common multi-byte string (mbstring) functions, which are used to handle text in different languages and character sets for your site.
When triggered, the bug tricks PHP into reading data from server memory it is not authorized to access. This can lead to your website crashing unexpectedly, or in very rare cases, small amounts of private server data being leaked. The affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as the mbstring.detect_order and mbstring.http_output configuration settings that control how these text-processing tools operate.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
