A security flaw has been identified in specific older versions of PHP, the software that powers most dynamic websites. The issue only impacts sites that use PHP's SOAP functionality (a tool for communicating with external services) with session persistence enabled, a feature that stores certain session data across user requests to improve performance. Affected PHP versions include 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
When a SOAP request that triggers an error is sent to a site running one of these affected PHP versions, the software incorrectly handles the stored session data. This can lead to unexpected website crashes. In rare cases, the flaw may also allow unauthorized access to sensitive data stored on the server, or tampering with website content, impacting the site's security, reliability, and data integrity.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
