A security flaw has been identified in specific older versions of PHP, the software that powers most dynamic websites. The issue affects PHP 8.2 versions older than 8.2.31, 8.3 versions older than 8.3.31, 8.4 versions older than 8.4.21, and 8.5 versions older than 8.5.6.
The flaw exists in the part of PHP used to connect to Firebird databases. When building database queries that include a special, usually hidden NUL character, the system can accidentally cut off part of the query, breaking its intended structure. If your website uses the affected PHP versions and processes untrusted data in database queries built with the PDO::quote() function, this flaw could allow an attacker to run unauthorized database commands. This may lead to unauthorized access to your stored data, unwanted changes to your website content, or permanent data loss.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
