A security vulnerability has been identified in specific versions of PHP, the software that powers most dynamic, interactive websites. The affected versions are 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
The flaw occurs when a specific PHP feature called SoapServer is set up to retain temporary handler data between user visits via session storage, and an incoming SOAP request results in an error. In this scenario, the system incorrectly deletes the stored handler data but keeps an active reference to it, leading to a coding error known as use-after-free.
This error can cause a range of problems for affected systems, including unexpected website or server crashes, exposure of sensitive data stored on the server, or corruption of site data and functionality. It impacts the confidentiality, integrity, and availability of any systems running the vulnerable PHP versions.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
