A security flaw has been identified in specific versions of PHP, the software that powers most dynamic websites, content management systems, and web applications. The issue affects PHP 8.4 releases older than 8.4.21, and PHP 8.5 releases older than 8.5.6. The bug triggers when common text encoding functions (used to convert or detect the character set of text processed by your site) receive input containing a hidden null byte. Due to a coding error, the software miscalculates the length of this input, leading it to access memory it is not authorized to use. This may cause your website to crash unexpectedly, or in very rare cases, leak small amounts of sensitive information. The affected functions include mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order(), as well as two PHP settings that control default text encoding behavior for your site.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
