A security flaw has been identified in specific versions of PHP, the open-source software that powers most dynamic websites. The issue impacts PHP 8.4.* releases older than 8.4.21 and PHP 8.5.* releases older than 8.5.6.
The vulnerability is triggered when a specially crafted input containing a hidden null byte is sent to common PHP tools used for character encoding conversion and detection, including features that control how websites handle different text encodings. A coding error in these tools causes the software to read memory it is not permitted to access when processing this type of input.
This unauthorized memory access can lead to two potential risks for affected sites: unexpected crashes that make the site temporarily unavailable, or in rare cases, unintended exposure of sensitive data stored on the server.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
