A security flaw has been identified in specific versions of PHP, the software that powers many dynamic websites. The flaw impacts PHP 8.4 releases older than version 8.4.24, and PHP 8.5 releases older than version 8.5.9.
The issue is triggered when an attacker sends specially crafted input to a PHP function used for comparing large decimal numbers, a common task when processing user-submitted data like form entries, payment amounts, or other numeric values. This causes the software to write data to the wrong area of the website's memory, corrupting both temporary working data and stored site information.
This type of memory corruption can be exploited for malicious purposes, including gaining unauthorized control of your site, stealing visitor or account data, or altering your site's content without permission.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-17544
