A security vulnerability has been identified in specific versions of PHP, the software that powers most dynamic websites and web applications. The flaw exists in the SOAP extension, a component used to handle data exchanges for certain web services, and impacts PHP 8.2 versions older than 8.2.31, PHP 8.3 versions older than 8.3.31, PHP 8.4 versions older than 8.4.21, and PHP 8.5 versions older than 8.5.6.
The issue arises when the SOAP extension processes requests with duplicate data entries, which can leave behind outdated pointers to memory that has been freed up for other use. If an attacker is able to send a specially crafted SOAP request to a site running an affected PHP version, they could exploit this flaw to run unauthorized, malicious code on the server that hosts the site.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-6722
