Multiple Vulnerabilities in PHP (GovCERT.HK A26-07-52): Phar Symlink DoS, Bundled-libgd GIF Memory Corruption, pgsql SQL Injection, and BCMath Out-of-Bounds Write (CVE-2026-7260, CVE-2026-9672, CVE-2026-17543, CVE-2026-17544) — Threadlinqs Intelligence
As of 2026-07-31, Multiple Vulnerabilities in PHP (GovCERT.HK A26-07-52): Phar Symlink DoS, Bundled-libgd GIF Memory Corruption, pgsql SQL Injection, and BCMath Out-of-Bounds Write (CVE-2026-7260, CVE-2026-9672, CVE-2026-17543, CVE-2026-17544) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1782 · Severity: HIGH · CVSS: 8.1 · Status: ACTIVE · Category: VULNERABILITY
PHP shipped coordinated security releases (8.2.33, 8.3.33, 8.4.24, 8.5.9, all dated 2026-07-30) fixing four vulnerabilities: a Phar circular-symlink stack-exhaustion crash, a bundled-libgd GIF LZW
On 2026-07-28 the PHP project committed fixes for four independently-discovered vulnerabilities to php-src master and all four supported release branches within a roughly three-hour window; the fixes shipped publicly on 2026-07-30 as PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33. GovCERT.HK published Security Alert A26-07-52 on 2026-07-31 summarizing the release without individual CVE technical detail, stating only that exploitation "could lead to denial of service or tampering."
1) CVE-2026-7260 (Phar, CWE-121/CWE-400/CWE-674, CVSS 5.4 v4, GHSA-vc5h-9ppw-p5f3): phar_get_link_source() in ext/phar/util.c recursively resolves symbolic links inside phar (PHP Archive) files with no depth limit or cycle detection. A crafted tar-based .phar archive containing mutually-referencing symlinks (file_a -> file_b -> file_a) drives unbounded recursion when content is retrieved (e.g. via Phar::getContent()), exhausting the C call stack and crashing the PHP process. The same release also fixed inconsistent handling of the magic ".phar" directory (paths merely starting with ".phar" vs the true magic path) across file/directory creation, copy, ArrayAccess, stream lookup, iteration, and extraction. Credited to Calvin Young (eWalker Consulting) and Enoch Chow (Isomorph Cyber).
2) CVE-2026-9672 (bundled libgd/GD extension, GIF decoder): a patch authored by Pierre Joye and committed by Ilija Tovilo on 2026-07-28 fixed ext/gd/libgd/gd_gif_in.c's LWZReadByte_() LZW-decompression routine. The code incorrectly executed `sd->table[0][i] = sd->table[1][0] = 0;` instead of `sd->table[0][i] = sd->table[1][i] = 0;` when initializing the GIF LZW code table, and was missing a bounds-check return path (an added `return -2;`). A maliciously crafted GIF image processed by the GD extension (e.g. an attacker-supplied image upload later thumbnailed/re-encoded by a web application) can corrupt the LZW table state, leading to memory corruption during decode. NVD had not yet published a CVSS score/CWE for this CVE at analysis time ("Awaiting Analysis"); given the memory-safety class of the bug (analogous to historical GD/GdkPixbuf GIF LZW flaws such as CVE-2021-44648), it is assessed here as at least a denial-of-service risk with unconfirmed code-execution potential pending a full NVD writeup.
3) CVE-2026-17543 (pgsql extension, CWE-89, CVSS 8.1 v4 HIGH, GHSA-7qpv-r5mr-78m4): php_pgsql_convert() in ext/pgsql/pgsql.c (~lines 4751-4757), used by pg_insert(), pg_update(), pg_select(), and pg_delete(), wraps escaped values in PostgreSQL escape-string constants (E'...') using PQescapeStringConn(). PQescapeStringConn() does not escape backslashes when the server has standard_conforming_strings = on -- the PostgreSQL default since version 9.1 -- allowing an attacker-controlled value ending in a backslash to prematurely terminate the E'...' literal and inject arbitrary SQL. Published PoC: `pg_select($db, 'user', ['name' => "zzz\\' OR 1=1 --"])` renders as `SELECT * FROM "user" WHERE "name"='zzz\'' OR 1=1 --';`, returning all rows. The fix switches php_pgsql_convert() to use non-escaping string constants so backslash breakout is no longer possible. Reported by ExPatch-LLC; fix by iluuu1994, reviewed by mbeccati, analysis by alexandre-daubois.
4) CVE-2026-17544 (bcmath extension, CWE-121/CWE-787, CVSS 8.1 v4 HIGH, GHSA-x692-q9x7-8c3f): bc_str2num() in ext/bcmath/libbcmath/src/str2num.c mishandles trailing-zero truncation when a caller-specified scale shortens a numeric string. The code adjusts str_scale (`str_scale -= fractional_end - fractional_new_end;`) but fails to also adjust fractional_end, so bc_copy_and_toggle_bcd() subsequently copies BCD data past the shortened allocation -- an out-of-bounds write reachable via bccomp() with attacker-controlled operand and scale, corrupting stack or heap memory depending on whether BCMath's arena allocator or a heap fallback backs the buffer. Reported by recepasan; analysis by iluuu1994. Only PHP 8.4.x (before 8.4.24) and 8.5.x (before 8.
Weaknesses (CWE)
CWE-674, CWE-400, CWE-121, CWE-89, CWE-787
Target sectors: government administration, technology, financial-services, ecommerce, health, education
Target regions: hong kong, Global
Related threats
- HollowByte: OpenSSL Pre-Authentication TLS DoS Flaw Bloats Server Memory With 11-Byte Payload
- Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues)
- Microsoft's MDASH AI Scanning Harness Uncovers 16 Windows CVEs, Including Four Critical RCE Flaws in TCP/IP, IKEv2, Netlogon, and DNS
- CVE-2025-62507: Unauthenticated Stack-Based Buffer Overflow RCE in Redis XACKDEL Command
- Six AirDrop and Quick Share Proximity File-Transfer Vulnerabilities (Apple, Google, Samsung) — 'Protocol Prying' Research
- HTTP/2 Bomb — Remote DoS via HPACK Indexed-Reference Compression Bomb + Zero-Window Flow-Control Hold Affecting nginx, Apache httpd, IIS, Envoy & Cloudflare Pingora (CVE-2026-49975, Public PoC)
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-7260, CVE-2026-9672, CVE-2026-17543, CVE-2026-17544, T1592, T1190, T1203, T1068, T1027, T1140, T1552, T1082, T1213, T1499
