Security
Outdated PHP patches leave supported branches exposed
mySites.guru says PHP 8.5.7 is behind on security patches even though it is newer than fully patched PHP 8.4.24.
The report concerns the PHP project and security fixes released across supported branches. It identifies three vulnerabilities in PHP components: an out-of-bounds write in BCMath, SQL injection in the PostgreSQL extension, and a crash in Phar.
CVE-2026-17544: out-of-bounds write inBCMathCVE-2026-17543: SQL injection in thePostgreSQLextensionCVE-2026-7260: crash inPhar
According to mySites.guru, the fixes are included in 8.2.33, 8.3.33, 8.4.24 and 8.5.9. Versions below the corresponding fixed release are affected. The write-up does not provide CVSS ratings or report active exploitation of these specific issues.
Administrators should update to the newest patch available for their PHP branch, with priority given to supported branches. PHP 8.2 and 8.3 receive security fixes only, while PHP versions below 8.2 are outside the supported lifecycle and should be migrated.
Originally reported by mySites.guru.