Critical PHP Vulnerabilities Enable SQL Injection, Stack Overflow, and Memory Corruption

The PHP development team has disclosed three security vulnerabilities affecting core extensions, with fixes shipped in PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The flaws span SQL injection, uncontrolled recursion, and out-of-bounds memory writes, impacting applications that rely on ext-pgsql , ext-phar , and ext-bcmath . Security researcher iluuu1994 published all three advisories on GitHub Security Advisories. The most severe of the three, rated High, is CVE-2026-17543 , an…