A security flaw has been identified in specific versions of PHP, the software that powers most dynamic, interactive websites. The issue affects PHP 8.2 versions older than 8.2.31, 8.3 versions older than 8.3.31, 8.4 versions older than 8.4.21, and 8.5 versions older than 8.5.6. This flaw only impacts websites that use PHP's SOAP server feature with session persistence enabled, a configuration used for some custom web service integrations and internal business tools. When a SOAP request to these servers returns an error, a coding mistake causes the system to release memory tied to a request handler while still holding a reference to that memory, creating a critical use-after-free vulnerability. If successfully exploited, this could allow attackers to access sensitive information stored on your hosting account, modify or corrupt your website's data and content, or crash your site so it is unavailable to visitors.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
