A security vulnerability, tracked as CVE-2026-7261, exists in older versions of PHP, the software many websites use to run dynamic features. The affected versions are PHP 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
The flaw impacts sites that use PHP's SOAP server feature with session persistence enabled, a setting that saves request data across user sessions. When a SOAP request returns an error, the system mishandles this stored session data, leading to a memory error that can cause unexpected system behavior.
This error can trigger process crashes, expose sensitive information stored on the system, or corrupt data. As a result, the vulnerability may impact the confidentiality of private site data, the integrity of site content and user information, and the availability of your site and related services.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-7261
