Critical SQL Injection and C Stack Exhaustion Vulnerabilities in PHP7 and PHP8

Recent updates for openSUSE's PHP7 and PHP8 address critical vulnerabilities, including CVE-2026-17543, which allows SQL injection through improper escaping of backslashes in user parameters, and CVE-2026-7260, which can lead to C stack exhaustion due to circular symbolic links in phar archives. Both vulnerabilities were published on July 30, 2026, with a proof of concept for CVE-2026-17543 released on August 4, 2026. Affected systems include various versions of SUSE Linux Enterprise Server and High Performance Computing products. Administrators are urged to apply patches immediately to mitigate potential exploits. The vulnerabilities pose significant risks due to their critical nature and the ease of exploitation.

Key Points: • Critical vulnerabilities in PHP7 and PHP8 require immediate patching. • CVE-2026-17543 allows SQL injection due to improper escaping of user parameters. • CVE-2026-7260 can cause C stack exhaustion through circular symbolic links.