SKYLINE Blog

Security advisory Cybersecurity

PHP security releases of 30 July 2026: 8.5.9, 8.4.24, 8.3.33 and 8.2.33 fix pgsql SQL injection

PHP's 30 July 2026 releases fixed SQL injection in pg_insert()/pg_select() and friends, a bccomp() memory write, a libgd flaw and a phar crash.

Published
Reading time
5 min read

Security advisory Vulnerability

Severity: High Status: Patched
CVE IDs
Status
Fixed upstream in PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33. Distribution packages carry the fixes under their own version numbers.
Affected
  • PHP 8.5 before 8.5.9
  • PHP 8.4 before 8.4.24
  • PHP 8.3 before 8.3.33
  • PHP 8.2 before 8.2.33
Published
Updated

What you should do

  • Update PHP, and on Debian the libgd2 library, then restart PHP services.
  • Move code that builds queries with pg_insert(), pg_update(), pg_select() or pg_delete() to parameterised queries where practical.
  • Do not open phar archives or GIF images from untrusted sources without size and type checks.
  • See our php2shell article for the October 2026 fixes.
Timeline
  1. The PHP project released PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33.
  2. Skyline published this summary.

On 30 July 2026 the PHP project released PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33 as security releases. The fix most likely to matter to ordinary web applications is an SQL injection in the PostgreSQL extension's convenience functions such as pg_insert() and pg_select(). The round also fixes an out-of-bounds write in bccomp(), updates the bundled GD library and stops a crash caused by crafted phar archives.

At a glance

ItemDetails
ProductPHP (php-src), branches 8.2 to 8.5
Fixed versions8.5.9, 8.4.24, 8.3.33, 8.2.33 (30 July 2026)
CVEsCVE-2026-17543, CVE-2026-9672, CVE-2026-7260 (all branches); CVE-2026-17544 (8.4 and 8.5 only)
SeverityHigh (PHP advisories for CVE-2026-17543 and CVE-2026-17544)
DebianDSA-6406-1 (trixie, php8.4 8.4.24-1~deb13u1, 31 July); DLA-4732-1 (bookworm, php8.2 8.2.33-1~deb12u1, 11 August)

What the vulnerabilities are

CVE-2026-17543: SQL injection in pgsql helper functions

pg_insert(), pg_update(), pg_select() and pg_delete() escape values with PQescapeStringConn() and then wrap them in an E'...' escape string constant. With standard_conforming_strings = on, the PostgreSQL default since version 9.1, that escaping does not double backslashes, so a value containing a backslash followed by a quote can end the string early and inject SQL. PHP's advisory GHSA-7qpv-r5mr-78m4 rates it High, and the CVE record scores it CVSS 4.0 8.1. The fix switches to non-escaping string constants. Code that uses pg_query_params() or PDO prepared statements does not go through this path.

CVE-2026-17544: out-of-bounds write in bccomp() (8.4 and 8.5)

Attacker-supplied operands and scale passed to bccomp() could cause an out-of-bounds write with stack and heap corruption. PHP rates it High (GHSA-x692-q9x7-8c3f, CVSS 4.0 8.1). Debian's tracker notes the code was introduced in 8.4.3 and is not present in 8.2.

CVE-2026-9672: GD library update

The ChangeLog lists this as an upgrade of the bundled libgd. Debian's advisories for its separate libgd2 package describe a flaw that may cause denial of service or potentially code execution when a malformed GIF file is processed. The CVE had no published record on CVE.org when we checked.

CVE-2026-7260: phar crash with circular symlinks

A crafted tar-based phar archive with symbolic links pointing at each other causes unbounded recursion and crashes the PHP process (GHSA-vc5h-9ppw-p5f3, Medium, CVSS 4.0 5.4).

None of these CVEs is in CISA's Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

Upstream builds older than 8.5.9, 8.4.24, 8.3.33 or 8.2.33 are affected. To find the risky pgsql calls in your code:

php -v
grep -rnE 'pg_(insert|update|select|delete)\(' /var/www --include='*.php' | head

On Debian, compare with DSA-6406-1 (trixie) and DLA-4732-1 (bookworm). Debian fixed the GD issue in the libgd2 library separately: DSA-6409-1 (trixie, 2.3.3-14~deb13u1) and DLA-4731-1 (bookworm, 2.3.3-9+deb12u1). The library's binary package is libgd3:

apt policy php8.4-pgsql libgd3   # trixie
apt policy php8.2-pgsql libgd3   # bookworm

Ubuntu users should check Ubuntu Security Notices.

How to update

On Debian and Ubuntu, sudo apt update followed by sudo apt upgrade installs both the PHP and libgd updates. For source, Windows and container builds, use the newest release of your branch from php.net/downloads; as of 31 October 2026 that is 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

Restart or reboot?

No reboot. Restart PHP-FPM, Apache (mod_php) and long-running PHP workers so they load the new PHP and the new libgd:

sudo systemctl restart php8.4-fpm   # or php8.2-fpm on bookworm

Sources

Topics

SKYLINE Engineering

@skyline

The engineering team at SKYLINE Industrial Solutions. We publish field-tested guides drawn from real KSA and GCC deployments.

See author profile
More in Cybersecurity

Related: Skyline Nexus ERP guides

Nexus knowledge base →
Skyline Nexus ERP

Gulf & Middle East tax and e-invoicing guides

VAT, ZATCA e-invoicing and corporate tax explained for Saudi Arabia, the UAE and the wider GCC.

 Skyline Nexus ERP

Skyline Nexus ERP — cloud accounting & ZATCA e-invoicing

Our cloud ERP: accounting, invoicing, inventory and POS in one place. First month free.
SKYLINE engineering services

Need this implemented for you?

Reading is free — building it right takes a team. SKYLINE engineers ship Cybersecurity for Aramco vendors, banks, hospitals and government agencies across Saudi Arabia. Talk to us before you start.

Cybersecurity & Data Centre SACS-210, NCA ECC, SOC, 24/7 ops Firewall & Network Security Fortinet, Palo Alto, segmentation, ZTNA
Talk to a SKYLINE engineer Call +966 50 993 9334
Aramco Approved Contractor ISO 9001 · ISO 27001 SAMA CSF aligned NCA ECC ready 247+ KSA clients

Comments

0 total · 0 threads
Be the first to leave a comment.