A security flaw has been identified in specific releases of PHP, the core software that powers most dynamic websites. The issue affects PHP 8.4 versions older than 8.4.21, and PHP 8.5 versions older than 8.5.6.
The flaw is triggered when a specially crafted input containing a hidden null byte in an encoding name is passed to common text-processing PHP functions. Affected features include the mb_convert_encoding(), mb_detect_encoding(), mb_convert_variables(), and mb_detect_order() functions, as well as the mbstring.detect_order and mbstring.http_output server settings. A coding error in these tools can cause the software to read server memory it is not supposed to access.
In practice, this could lead to unexpected website crashes, or in very rare cases, the unintended disclosure of sensitive information stored on the server.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
