Full Report
PHP Group security advisory (AV26-764)
Analysis Summary
# Vulnerability: Critical Flaws in PHP (SQL Injection & Memory Corruption)
## CVE Details
- **CVE ID:** CVE-2026-XXXX (Specific IDs pending, associated with GHSA-7qpv-r5mr-78m4 and GHSA-x692-q9x7-8c3f)
- **CVSS Score:** 7.5 - 9.8 (Estimated High to Critical)
- **CWE:** CWE-89 (SQL Injection), CWE-787 (Out-of-bounds Write)
## Affected Systems
- **Products:** PHP
- **Versions:**
- PHP 8.2.x prior to 8.2.33
- PHP 8.3.x prior to 8.3.33
- PHP 8.4.x prior to 8.4.24
- PHP 8.5.x prior to 8.5.9
- **Configurations:** Systems using `ext-pgsql` for PostgreSQL databases or the `bcmath` extension for arbitrary precision mathematics.
## Vulnerability Description
This advisory covers two distinct security flaws:
1. **PostgreSQL SQL Injection:** A flaw in the `ext-pgsql` extension where specific backslash escaping sequences (`E'...'`) can be broken out of, allowing an attacker to bypass sanitization and inject malicious SQL commands.
2. **`bccomp()` Out-of-bounds Write:** A memory corruption vulnerability in the `bccomp()` function. When processing a specially crafted operand and scale value, the function can perform an out-of-bounds write, potentially leading to a crash or remote code execution (RCE).
## Exploitation
- **Status:** PoC concepts likely available via GitHub security advisories; no confirmed exploitation in the wild at time of reporting.
- **Complexity:** Medium (Requires specific application logic to pass user-controlled input to affected functions).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Data theft via SQL injection).
- **Integrity:** High (Data modification or memory corruption).
- **Availability:** High (Service denial via application crashes).
## Remediation
### Patches
The PHP Group has released the following security updates:
- Upgrade to **PHP 8.2.33**
- Upgrade to **PHP 8.3.33**
- Upgrade to **PHP 8.4.24**
- Upgrade to **PHP 8.5.9**
### Workarounds
- **SQLi:** Implement server-side input validation and avoid using `ext-pgsql`'s manual escaping; utilize prepared statements via PDO where possible.
- **Memory Corruption:** Disable or restrict user input to the `bcmath` extension's `bccomp()` function until patches are applied.
## Detection
- **Indicators of Compromise:** Monitor database logs for unusual SQL syntax or escape characters (backslashes) in unexpected locations. Check system logs for "Segmentation Faults" or process crashes related to PHP-FPM or Apache.
- **Detection methods:** Use Static Application Security Testing (SAST) tools to identify calls to `bccomp()` and manual PostgreSQL query building.
## References
- **Vendor Advisory:** hxxps[://]github[.]com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4
- **Vendor Advisory:** hxxps[://]github[.]com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f
- **Cyber Centre Alert:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/php-group-security-advisory-av26-764