CVE-2026-7568 PHP Group CVE debrief

Who should care

Administrators and developers running PHP applications that call metaphone(), especially in services that accept user-supplied text or process untrusted input at scale. SRE and platform teams should care if PHP process availability is business-critical, since the issue can cause denial of service through a crash.

Technical summary

The vulnerability is caused by use of a signed int to track the current position within the input string in ext/standard/metaphone.c. If the input exceeds 2,147,483,647 bytes, the position counter overflows, creating undefined behavior. The described impact is an out-of-bounds read that may crash the PHP process or expose unrelated memory contents to the process context. NVD maps the issue to CWE-125 and CWE-190.

Defensive priority

Medium. The primary impact is availability, but the bug is in a widely deployed core PHP function and can be triggered by pathological input size. Prioritize if your applications can pass user-controlled text into metaphone() or if PHP process crashes materially affect uptime.

Recommended defensive actions

• Upgrade PHP to a fixed release: 8.2.31, 8.3.31, 8.4.21, or 8.5.6 or later, depending on your branch.
• Audit application code and frameworks for use of metaphone() and verify whether any call paths can receive untrusted or excessively large input.
• Add input-size limits and request validation before text reaches PHP string-processing routines, especially in public-facing services.
• Monitor PHP error logs and crash telemetry for unexplained segmentation faults or worker restarts around text-processing endpoints.
• If immediate upgrading is not possible, reduce exposure by restricting or removing code paths that invoke metaphone() on attacker-controlled data.

Evidence notes

The vulnerability description and affected-version ranges come from the supplied CVE record and NVD source item. NVD lists the reference to the PHP project security advisory at https://github.com/php/php-src/security/advisories/GHSA-96wq-48vp-hh57. No additional claims are made beyond the provided corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.