A security flaw has been found in specific versions of PHP, the common software used to run many dynamic websites. The affected versions are 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
This issue only impacts sites that use PHP's SoapServer feature set to save SOAP request data across user sessions. When a SOAP request using this setup returns an error, a coding mistake can cause the system to reference memory that has already been released. This may lead to site crashes, unexpected broken functionality, or in some cases, unauthorized access to sensitive site data or unwanted changes to site content. Sites that do not use this specific SoapServer configuration are not affected by this flaw.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
