Back Linuxsecurity

Ubuntu PHP Critical Use-After-Free SQL Injection USN-8513

Linuxsecurity •LinuxSecurity Advisories • July 6, 2026

PHP could be made to crash or run programs if it received specially crafted network traffic. Software Description: - php7.0: HTML-embedded scripting language interpreter Details: It was discovered that PHP incorrectly handled SOAP object deduplication when processing apache:Map nodes with duplicate keys. An attacker could possibly use this to cause a use-after-free, resulting in remote code execution. (CVE-2026-6722) It was discovered that PHP incorrectly handled SOAP request persistence when configured with SOAP_PERSISTENCE_SESSION. An attacker could possibly use this to cause a use-after-free, resulting in memory corruption, information disclosure, or a denial of service. (CVE-2026-7261) It was discovered that the PDO Firebird driver in PHP improperly handled NUL bytes when quoting SQL query strings. An attacker could possibly use this to perform SQL injection when attacker-controlled values are embedded in SQL statements. (CVE-2025-14179)

PHP could be made to crash or run programs if it received

specially crafted network traffic.

Software Description:

- php7.0: HTML-embedded scripting language interpreter

It was discovered that PHP incorrectly handled SOAP object deduplication

when processing apache:Map nodes with duplicate keys. An attacker could

possibly use this to cause a use-after-free, resulting in remote code

execution. (CVE-2026-6722)

It was discovered that PHP incorrectly handled SOAP request persistence when

configured with SOAP_PERSISTENCE_SESSION. An attacker could possibly use this

to cause a use-after-free, resulting in memory corruption, information

disclosure, or a denial of service. (CVE-2026-7261)

It was discovered that the PDO Firebird driver in PHP improperly handled NUL

bytes when quoting SQL query strings. An attacker could possibly use this to

perform SQL injection when attacker-controlled values are embedded in SQL

statements. (CVE-2025-14179)

The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS php7.0-interbase 7.0.33-0ubuntu0.16.04.16+esm19 Available with Ubuntu Pro php7.0-soap 7.0.33-0ubuntu0.16.04.16+esm19 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2025-14179, CVE-2026-6722, CVE-2026-7261

Ubuntu Security Notice USN-8513-1

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Lead to Remote Code Execution and SQL Injection Risks Multiple vulnerabilities in PHP have been disclosed, allowing attackers to exploit use-after-free conditions leading to remote code execution and SQL injection. Specifically, CVE-2026-6722 and CVE-2026-7261 relate to improper handling of SOAP requests and object deduplication, while CVE-2025-14179 involves the PDO Firebird driver mishandling NUL bytes. These vulnerabilities can be triggered by specially crafted network traffic, affecting systems running PHP 7.0. The issues were published on May 10, 2026, and have been confirmed by security advisories. Users are urged to update their systems to mitigate these risks. 2 sources 71

Extracted Entities

Ubuntu PHP Critical Use-After-Free SQL Injection USN-8513

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (3)

CWE Weaknesses (4)

MITRE ATT&CK (1)

Platforms (4)