A cluster of significant vulnerabilities has been discovered in PHP’s core string processing and ext-soap components, posing an immediate threat to numerous web servers worldwide.
The SOAP extension is historically known for memory corruption issues; however, this latest revelation marks a severe escalation into unauthenticated Remote Code Execution (RCE).
In response, GitHub security teams are urgently collaborating with PHP maintainers to deploy emergency patches, aiming to prevent potential server compromises.
Understanding the Critical Flaw
The most severe vulnerability, identified as CVE-2026-6722, is a high-risk use-after-free flaw within the PHP SOAP extension.
This vulnerability arises due to improper handling of object deduplication in XML graphs, utilizing id and href attributes.
Security experts warn that this flaw allows attackers to manipulate memory usage, leading to unauthorized code execution.
Additional SOAP Vulnerabilities Exposed
Beyond the primary RCE vulnerability, other issues were uncovered in the PHP SOAP extension.
For instance, CVE-2026-7261 involves a use-after-free error in SoapServer linked to session-persisted objects, while CVE-2026-7262 addresses a NULL pointer dereference that could crash PHP processes.
Furthermore, CVE-2026-7258 and CVE-2026-6104 expose out-of-bounds read errors and buffer overruns, respectively, adding to the security concerns.
Urgent Need for Security Patches
These vulnerabilities impact several PHP versions, specifically those prior to 8.2.31, 8.3.31, 8.4.21, and 8.5.6, with the mbstring issue affecting versions before 8.4.21 and 8.5.6.
Administrators are strongly urged to update their PHP environments immediately to prevent exploitation.
Patches developed by contributors iluuu1994, iliaal, and ndossche are now integrated into the latest PHP releases, offering crucial protection against these security threats.
Conclusion and Future Implications
The discovery of these vulnerabilities underscores the importance of regular software updates and vigilant security practices in web development.
Organizations relying on the SOAP extension must prioritize these patches to safeguard essential infrastructure from potential attacks.
Stay informed on the latest developments by following us on Google News, LinkedIn, and X for more timely updates.
