A flaw has been identified in specific versions of PHP, the software that powers most dynamic websites. The issue affects PHP 8.4 releases older than 8.4.21, and PHP 8.5 releases older than 8.5.6. The flaw is in PHP’s mbstring feature, which handles text encoding conversions and detection for website content. If input containing a hidden, hard-to-spot NUL byte is passed to affected mbstring functions, or if certain related mbstring settings are used, the system miscalculates the length of the input. This miscalculation can cause your website to crash unexpectedly, or in rare cases expose small amounts of server memory data. Affected tools include functions for converting and detecting text encodings, as well as related mbstring configuration settings.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
