A security vulnerability has been found in specific recent versions of PHP, the software that powers most dynamic websites. The affected versions are 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6. The flaw is triggered when a specially crafted input containing a hidden null byte is sent to PHP's character encoding tools, including functions like mb_convert_encoding and related encoding detection tools, as well as specific PHP settings for character encoding handling. If exploited, this issue could cause your website to crash unexpectedly, or in some cases allow unauthorized access to small amounts of sensitive server memory data.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6104
