PHP security releases fix SQL injection and out-of-bounds write
Four branches ship fixes for PostgreSQL injection, Phar crashes, libgd, and a BCMath flaw limited to newer lines.
PHP has issued coordinated security releases across four supported branches, closing an SQL injection hole in the PostgreSQL extension and several other flaws that could crash interpreters or corrupt memory.
PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33 all address CVE-2026-17543, an SQL injection reachable through E'...' string escape breakout in the PGSQL extension. The same releases fix CVE-2026-7260, a crash caused by recursive symlinks when handling Phar archives, and CVE-2026-9672 by upgrading the bundled libgd image library.
The two newest branches add a further fix for CVE-2026-17544, an out-of-bounds write in BCMath comparison. All four builds are marked security releases by the project.