A security flaw has been identified in specific releases of PHP, the core software that powers most dynamic websites. The issue affects PHP 8.4 versions older than 8.4.21, and PHP 8.5 versions older than 8.5.6.The flaw is triggered when a specially crafted input containing a hidden null byte in an encoding name is passed to common text-processing ...
Continue reading
A security flaw has been found in specific versions of PHP, the common software used to run many dynamic websites. The affected versions are 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.This issue only impacts sites that use PHP's SoapServer feature set to save ...
Continue reading
A security flaw, tracked as CVE-2026-6722, has been identified in specific older versions of PHP, the software that powers most dynamic websites. The flaw affects PHP 8.2 versions older than 8.2.31, 8.3 versions older than 8.3.31, 8.4 versions older than 8.4.21, and 8.5 versions older than 8.5.6, and exists in PHP's SOAP extension, a tool used to ...
Continue reading
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and ...
Continue reading
