PHP security releases of May 2026: 8.5.6, 8.4.21, 8.3.31 and 8.2.31 fix SOAP, PDO_Firebird and FPM flaws

On 7 May 2026 the PHP project released PHP 8.5.6, 8.4.21, 8.3.31 and 8.2.31 as security releases. It was the first security round of 2026, and a large one: eight CVEs fixed on every supported branch, three more on 8.4 and 8.5, and one more on 8.5 only. The most serious is a use-after-free in the SOAP extension that, according to its CVE record, an attacker controlling the SOAP request body could use for remote code execution.

At a glance

What the vulnerabilities are

SOAP extension

• CVE-2026-6722 (GHSA-85c2-q967-79q5, High): when an apache:Map node contains duplicate keys, the SOAP decoder frees an object while a stale pointer to it remains. The CVE record says an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. It is scored CVSS 4.0 9.5.
• CVE-2026-7261 (Medium): with SOAP_PERSISTENCE_SESSION, a failing SOAP header handler can leave a freed object referenced across requests, which may lead to memory corruption, information disclosure or crashes.
• CVE-2026-7262 (Medium in the advisory, CVSS 4.0 2.9 in the CVE record): a server with a typemap configured can be crashed by an apache:Map entry missing its value.

Database and web-facing issues

• CVE-2025-14179 (GHSA-w476-322c-wpvm, High): the PDO Firebird driver mishandled NUL bytes while building queries, so part of the query could be dropped and SQL injection becomes possible, even with values passed through PDO::quote().
• CVE-2026-6735 (GHSA-7qg2-v9fj-4mwv, Medium; CVSS 4.0 7.3 in the CVE record): the PHP-FPM status page did not sanitise the request URI. An attacker can plant script in a URL so that it runs in the browser of whoever later views the status page in HTML mode. The attacker does not need access to the status page.

Crashes and memory errors

• CVE-2026-7263 (High, 8.4 and 8.5): DOMNode::C14N() could corrupt a linked list, causing crashes or endless loops.
• CVE-2026-12184 (GHSA-mhmq-mmqj-2v39, High, 8.3 to 8.5): if TLS setup fails while the HTTP stream wrapper connects, for example because of an expired certificate on the remote server, PHP could crash; the advisory says this can take down an FPM process with its workers.
• CVE-2026-6104 and CVE-2026-7259: an out-of-bounds read when an encoding name contains a NUL byte, and a null pointer dereference in the mbstring regex functions with certain encodings.
• CVE-2026-7568: signed integer overflow in metaphone() with strings over 2 GB.
• CVE-2026-7258: out-of-bounds read in urldecode() on platforms where char is signed and ctype functions use lookup tables, such as NetBSD.
• CVE-2026-42371 (8.5 only): numeric truncation in the bundled uriparser library when handling URIs gigabytes long.

None of these CVEs is in CISA's Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

Upstream builds before 8.5.6, 8.4.21, 8.3.31 or 8.2.31 are affected. See which extensions you actually load:

php -v
php -m | grep -Ei 'soap|pdo_firebird|mbstring|dom'
grep -R 'pm.status_path' /etc/php/*/fpm/pool.d/

On Debian, compare with the advisories: DSA-6256-1 for Debian 13 (trixie) and DSA-6255-1 for Debian 12 (bookworm):

apt policy php8.4-fpm php8.4-soap   # trixie: fixed in 8.4.21-1~deb13u1
apt policy php8.2-fpm php8.2-soap   # bookworm: fixed in 8.2.31-1~deb12u1

How to update

Run sudo apt update and sudo apt upgrade on Debian or Ubuntu (Ubuntu users can follow Ubuntu Security Notices). For source, Windows and container builds, install the newest release of your branch from php.net/downloads; as of 31 October 2026 that is 8.5.12, 8.4.27, 8.3.36 or 8.2.35, which also include the php2shell fixes.

Restart or reboot?

No reboot. Restart PHP-FPM (sudo systemctl restart php8.4-fpm or php8.2-fpm), Apache if you use mod_php, and any long-running PHP workers.

Sources

• php.net/releases/8_5_6.php
• php.net/releases/8_4_21.php
• php.net/archive/2026.php
• php.net/ChangeLog-8.php#8.5.6
• github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
• github.com/php/php-src/security/advisories/GHSA-m33r-qmcv-p97q
• github.com/php/php-src/security/advisories/GHSA-hmxp-6pc4-f3vv
• github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
• github.com/php/php-src/security/advisories/GHSA-7qg2-v9fj-4mwv
• github.com/php/php-src/security/advisories/GHSA-4jhr-8w89-j733
• github.com/php/php-src/security/advisories/GHSA-mhmq-mmqj-2v39
• github.com/php/php-src/security/advisories/GHSA-74r9-qxhc-fx53
• github.com/php/php-src/security/advisories/GHSA-wm6j-2649-pv75
• github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57
• github.com/php/php-src/security/advisories/GHSA-m8rr-4c36-8gq4
• cve.org/CVERecord?id=CVE-2026-6722
• cve.org/CVERecord?id=CVE-2026-6735
• cve.org/CVERecord?id=CVE-2025-14179
• cve.org/CVERecord?id=CVE-2026-42371
• security-tracker.debian.org/tracker/DSA-6256-1
• lists.debian.org/debian-security-announce/2026/msg00167.html
• security-tracker.debian.org/tracker/DSA-6255-1
• lists.debian.org/debian-security-announce/2026/msg00166.html
• security-tracker.debian.org/tracker/CVE-2026-12184
• cisa.gov/known-exploited-vulnerabilities-catalog