Critical PHP Vulnerabilities Lead to Remote Code Execution and SQL Injection Risks

Multiple vulnerabilities in PHP have been disclosed, allowing attackers to exploit use-after-free conditions leading to remote code execution and SQL injection. Specifically, CVE-2026-6722 and CVE-2026-7261 relate to improper handling of SOAP requests and object deduplication, while CVE-2025-14179 involves the PDO Firebird driver mishandling NUL bytes. These vulnerabilities can be triggered by specially crafted network traffic, affecting systems running PHP 7.0. The issues were published on May 10, 2026, and have been confirmed by security advisories. Users are urged to update their systems to mitigate these risks.

Key Points: • PHP vulnerabilities allow remote code execution and SQL injection. • CVE-2026-6722 and CVE-2026-7261 involve use-after-free conditions. • Immediate updates are recommended for affected PHP versions.