Skip to main content

PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33

· One min read
Skpr Platform Team
Skpr Platform Team
Platform Engineering

Overview​

Our PHP versions have been updated to:

This is a security release, covering the following:

  • CVE-2026-17543 (PGSQL, PDO_PGSQL) - The PostgreSQL escaping functions don't escape backslashes, so user input placed inside an E'...' string literal can break out of the quotes and inject SQL.
  • CVE-2026-17544 (BCMath) - bccomp() could write outside its allocated buffer when the scale argument trimmed trailing zeros from a fraction, for example bccomp("1.901", "0", 2). This one only affects 8.5 and 8.4.
  • CVE-2026-7260 (Phar) - Recursive symlinks inside a Phar archive crash the stream handler, which an attacker can use for denial of service.
  • CVE-2026-9672 (GD) - Upstream libgd upgrade that fixes image processing vulnerabilities.

Pull Request #195