PHP — популярный язык сценариев общего назначения, особенно подходящий для веб-разработки.

Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

Stack overflow in phar with circular symlinks

Out-of-bounds write in bccomp() via crafted operand and scale

SQL injection in ext-pgsql via E'...' backslash breakout

ELSA-2026-48170: php security, bug fix, and enhancement update (LOW)

Security update for php7

ELSA-2026-40416: php:8.2 security, bug fix, and enhancement update (LOW)

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.

In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before ...