CVE-2026-17543
published 2026-07-30CVE-2026-17543: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.*…
PriorityP356critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.33%
24.9th percentile
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php8.4 | — | — |
| php | php | — | — |
| php | php | >= 8.2.0 < 8.2.33 | 8.2.33 |
| php | php | >= 8.3.0 < 8.3.33 | 8.3.33 |
| php | php | >= 8.4.0 < 8.4.24 | 8.4.24 |
| php | php | >= 8.5.0 < 8.5.9 | 8.5.9 |
| php_7.4 | php | — | — |
| php_8.2 | php | — | — |
| php_8.3 | php | — | — |
| php_group | php | >= 8.2.* < 8.2.33 | 8.2.33 |
| php_group | php | >= 8.3.* < 8.3.33 | 8.3.33 |
| php_group | php | >= 8.4.* < 8.4.24 | 8.4.24 |
| php_group | php | >= 8.5.* < 8.5.9 | 8.5.9 |
| ubuntu | php7.0 | — | — |
| ubuntu | php8.1 | — | — |
| ubuntu | php8.3 | — | — |
| ubuntu | php8.5 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:X/U:X
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PHP Group up to 8.2.32/8.3.32/8.4.23/8.5.8 sql injection (EUVD-2026-51090 / Nessus ID 338335)
vuldb·2026-08-21·CVSS 9.8
CVE-2026-17543 [CRITICAL] PHP Group up to 8.2.32/8.3.32/8.4.23/8.5.8 sql injection (EUVD-2026-51090 / Nessus ID 338335)
A vulnerability described as critical has been identified in PHP Group PHP up to 8.2.32/8.3.32/8.4.23/8.5.8. This affects an unknown function. Such manipulation leads to sql injection.
This vulnerability is listed as CVE-2026-17543. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-09-10·CVSS 9.8
CVE-2026-17544 [CRITICAL] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled backslash escaping in the
PostgreSQL extension. An attacker could use this issue to perform SQL
injection attacks. (CVE-2026-17543)
It was discovered that PHP incorrectly handled certain inputs to the
bccomp() function. An attacker could use this issue to cause an out-of-
bounds write, resulting in a denial of service or possibly execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-17544)
It was discovered that PHP incorrectly handled circular symbolic links in
phar archives. An attacker could use this issue to cause unbounded
recursion, resulting in a denial of service. (CVE-2026-7260)
Instructions: In general, a standard system update
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.8
CVE-2026-7260 [CRITICAL] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: PHP could be made to crash or expose sensitive information if it received
specially crafted input.
It was discovered that PHP incorrectly handled Apache map decoding in SOAP
servers with a typemap configured. A remote attacker could use this issue
to cause a NULL pointer dereference, resulting in a denial of service.
(CVE-2026-7262)
It was discovered that PHP incorrectly handled signed integer overflow in
the metaphone() function. An attacker could use this issue to cause an
out-of-bounds read, resulting in a denial of service. (CVE-2026-7568)
It was discovered that PHP incorrectly handled circular symbolic links in
phar archives. An attacker could use this issue to cause unbounded
recursion, resulting in a denial of service. (CVE-2026-7260)
It was
Red Hat
php: ext-pgsql: PHP: SQL injection via improper backslash escaping
vendor_redhat·2026-07-30·CVSS 9.8
CVE-2026-17543 [CRITICAL] CWE-89 php: ext-pgsql: PHP: SQL injection via improper backslash escaping
php: ext-pgsql: PHP: SQL injection via improper backslash escaping
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causing a denial of service.
Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Important. A remote attacker could exploit this flaw to inject malicious SQL commands i
No detection rules found.
No public exploits indexed.
2026-07-30
Published