A security flaw has been identified in specific versions of PHP, the software that powers many dynamic websites. The issue occurs when backslashes in input provided by visitors to your site (such as form submissions or URL parameters) are not handled correctly. This creates a simple path for attackers to carry out SQL injection, a type of attack that lets bad actors send unauthorized commands to your website’s database.
If exploited, these attacks could allow attackers to access sensitive data stored on your site (like customer information or admin login credentials), modify or delete your site’s content, or disrupt normal site operations.
The affected PHP versions are 8.2 releases older than 8.2.33, 8.3 releases older than 8.3.33, 8.4 releases older than 8.4.24, and 8.5 releases older than 8.5.9.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-17543
