PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7262 PHP Group CVE debrief

CVE-2026-7262 is a denial-of-service vulnerability in PHP’s SOAP server handling when a typemap is configured. In affected releases, a decoding mistake checks the wrong variable when a value element is missing, leading to a NULL pointer dereference and segmentation fault. A remote unauthenticated attacker can trigger a crash in the PHP SOAP server process.

Vendor
PHP Group
Product
PHP
CVSS
LOW 2.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-10
Original CVE updated
2026-07-24
Advisory published
2026-05-10
Advisory updated
2026-07-24

Who should care

Teams running exposed PHP SOAP services, especially those that use typemap configuration, should treat this as an availability risk. Administrators of PHP 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6 should prioritize remediation.

Technical summary

The issue affects SOAP server decoding when a typemap is configured and a value element is missing. The code path checks the wrong variable, which can leave a NULL pointer dereferenced and cause a segmentation fault. The disclosed impact is limited to process crash / denial of service, with no integrity or confidentiality impact described in the supplied record.

Defensive priority

Low severity overall, but prioritize quickly if the affected PHP SOAP service is internet-facing or customer-critical because the impact is a remote unauthenticated crash.

Recommended defensive actions

  • Upgrade PHP to a fixed release: 8.2.31, 8.3.31, 8.4.21, or 8.5.6, or later.
  • Inventory PHP SOAP servers and confirm whether typemap configuration is in use.
  • Treat unexpected PHP-FPM, Apache module, or application process crashes as a security signal and review logs around SOAP requests.
  • If immediate upgrading is not possible, reduce exposure of SOAP endpoints with network controls and authentication at the perimeter where feasible.

Evidence notes

This debrief is based on the supplied CVE record and the NVD source item published on 2026-05-10, which references the PHP security advisory GHSA-hmxp-6pc4-f3vv. The supplied description provides the affected version ranges, trigger condition, and impact. No KEV entry or ransomware linkage was supplied, and no unsupported exploitation claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7262 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7262

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7262 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7262

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.