Three critical PHP vulnerabilities (CVE-2026-6722, CVE-2026-7261, CVE-2025-14179, all CVSS 9.8) allow remote code execution via SOAP object deduplication, memory corruption via SOAP request persistence, and SQL injection via the PDO Firebird driver's improper handling of NUL bytes. Affected versions are PHP 8.2.0 to 8.2.30, 8.3.0 to 8.3.30, 8.4.0 to 8.4.20, and 8.5.0 to 8.5.5. These are fixed in PHP versions 8.2.31, 8.3.31, 8.4.21, and 8.5.6.
It was discovered that PHP incorrectly handled SOAP object deduplication when processing apache:Map nodes with duplicate keys. An attacker could possibly use this to cause a use-after-free, resulting in remote code execution. (CVE-2026-6722) It was discovered that PHP incorrectly handled SOAP request persistence when configured with SOAP_PERSISTENCE_SESSION. An attacker could possibly use this to cause a use-after-free, resulting in memory corruption, information disclosure, or a denial of service. (CVE-2026-7261) It was discovered that the PDO Firebird driver in PHP improperly handled NUL bytes when quoting SQL query strings. An attacker could possibly use this to perform SQL injection when attacker-controlled values are embedded in SQL statements. (CVE-2025-14179)