CVE-2026-17543Patch(php / php)

HIGHCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch php php systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

php CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4

Weakness type (CWE)

CWE-89

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
14 mentions across 9 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 9 signals
Technical details provided in 9 signals
General: 3 classified signals
Disclosure: 2 classified signals
Peaked 6d ago at 4 mentions (2026-07-31); latest day: 2
14 total mentions across 9 days

Affected systems

Vendors

php

Products

php

Deep dive

Activity timeline14 mentions / 9d

Signal classification5 categories

Patch

750.0%

General

321.4%

Disclosure

214.3%

Active Exploitation

17.1%

PoC

17.1%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	2	General1Patch1
2026-07-30	1	Patch1
2026-07-31	4	Patch4
2026-08-03	1	Active Exploitation1
2026-08-07	1	Disclosure1
2026-08-11	1	General1
2026-08-13	1	PoC1
2026-08-14	1	General1
2026-08-23	2	Disclosure1Patch1

Full discourse14 posts

dbugs@ptdbugs76d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-17543 Vendor: PHP Group Product: PHP Description: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. Link: https://github.com/hunt-benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout #dbugs_vuln
Post summary
A publicly available PoC and exploit script for CVE-2026-17543 has been released, revealing a SQL injection vulnerability in PHP, but no evidence of active exploitation or patch has been provided.
18051225.5K
3.6K followersView on X
kokumօtօ@__kokumoto89d
Patch
PHPでPostgreSQLのSQLインジェクション脆弱性が修正。CVE-2026-17543はCVSSスコア8.1で、pg_insert, pg_update, pg_select, pg_deleteでのバックスラッシュの取扱不備に起因。BCMathにおけ境界外書込CVE-2026-17544と循環シンボリックリンクでのDoSCVE-2026-7260も修正。 https://securityonline.info/php-sql-injection-cve-2026-17543/
Post summary
The post announces that the SQL injection vulnerability CVE-2026-17543 in PHP’s PostgreSQL adapters has been fixed, along with related CVEs, and provides technical details and a fix.
020601.6K
7.8K followersView on X
iototsecnews@iototsecnews82d
Disclosure
PHP の 3件の深刻な脆弱性が FIS：SQLi／メモリ破壊／サーバ・クラッシュの恐れ https://iototsecnews.jp/2026/07/31/php-patches-three-flaws-enabling-sql-injection-memory-corruption-and-server-crashes/ PHP のデータベース処理／数値計算／アーカイブ読み込み時の不備などによる、複数の脆弱性 CVE-2026-17543／CVE-2026-17544／CVE-2026-7260 が公表されました。これらの問題は、入力値のエスケープ処理／バッファ境界の不適切な管理／参照追跡の不足などに起因しています。悪用された場合には、データベースの不正操作／メモリ破損による障害／システムの強制停止などが引き起こされる恐れがあります。対応策として、修正が含まれる最新バージョンへの速やかな移行と処理対象データの検証が有効です。システムを安全に利用するためにも、環境のアップデートを実施することが推奨されます。 #CVE202617543 #CVE202617544 #CVE20267260 #Vulnerability
Post summary
Three new PHP vulnerabilities (CVE‑2026‑17543, CVE‑2026‑17544, CVE‑2026‑7260) have been disclosed, exposing SQL injection, memory corruption, and server crashes; users should update to the latest release and validate input data.
01000205
505 followersView on X
Shinjae Kang@zemnanet91d
Patch
PHP 8.5.9 fixes CVE-2026-17543: pgsql SQL injection via E'...' backslash breakout. Laravel apps do not outrun a vulnerable PHP runtime. After you ship 8.5.9, what do you check first — CI image, base container, or the prod host? #php
Post summary
The post announces that PHP 8.5.9 patches CVE-2026-17543, a PHP-based SQL injection flaw, and urges checking deployment environments post-upgrade.
1000087
32 followersView on X
takenaka hiroya@Joe_Biden_ja65d
Patch
同じ日に同じリリースで直ったPHPの2件は、影響範囲がまったく違います。片方は8.2系まで遡り、もう片方は8.4.3RC1で入った回帰。バージョンと拡張の有無と呼び出しの有無を1本のシェルスクリプトに落として、4ケース流した出力を載せました。 https://blog.hashito.biz/2026/08/23/php-cve-2026-17543-17544-pgsql-bcmath-triage/
Post summary
The author notes that two separate PHP CVEs fixed on the same release have different impact scopes—one affecting versions back to 8.2 and the other a regression in 8.4.3RC1—and shares a script‑generated output of their triage.
0000073
562 followersView on X
takenaka hiroya@Joe_Biden_ja66d
Disclosure
PHPのPostgreSQL拡張にSQLインジェクション。対象はpg_insert/pg_update/pg_select/pg_deleteの4関数だけです。原因はエスケープ関数と埋め込み先の前提の食い違い。修正版は8.2.33/8.3.33/8.4.24/8.5.9。 https://cve.autoarticles.net/cve/CVE-2026-17543
Post summary
The text announces a SQL injection vulnerability in PHP’s PostgreSQL extension with specific affected functions and provides patch versions.
0000062
562 followersView on X
Dayl Arhipov@Dayle_hack75d
General
https://expatch.com/writeups/cve-2026-17543.html #CVE-2026-17543 #1day #0day
Post summary
The input merely cites a CVE link and hashtags, offering no substantive details on exploitation, mitigation, or technical attributes.
00000116
55 followersView on X
Saad NSSIRI@lil_saad_xx78d
General
Found an exposed /wp-content/ directory and potentially vulnerable PHP.CVE-2026-17543 (8.1) CVE-2026-7260 (5.4) Professional brain: Stop. Document. http://Disclose.No exploitation. Just responsible disclosure. 🖥️🕶️#CyberSecurity #BugBounty https://t.co/20xKotbCcr
Post summary
The post reports discovery of an exposed WordPress directory and two CVEs but offers neither exploit details nor mitigation guidance, concluding with a responsible disclosure statement.
0000049
48 followersView on X
VulDB 🛡@vuldb85d
Active Exploitation
Some increased actor activities are shown targeting PHP Group PHP (CVE-2026-17543) https://vuldb.com/vuln/384789/cti
Post summary
The tweet indicates that CVE-2026-17543 is being actively exploited by increased actor activity targeting PHP Group PHP.
00000125
2.3K followersView on X
キタきつね@foxbook89d
Patch
PHPのSQLインジェクション脆弱性CVE-2026-17543が最新リリースで修正されました PHP SQL Injection Flaw CVE-2026-17543 Patched in Latest Release #DailyCyberSecurity (Jul 31) https://securityonline.info/php-sql-injection-cve-2026-17543/
Post summary
The post announces that CVE-2026-17543, a SQL injection vulnerability in PHP, has been patched in the latest release, with no proof of concept or active exploitation reported.
00000286
4.9K followersView on X
g_kari@gizensya_kari89d
Patch
PHP SQL Injection Flaw CVE-2026-17543 Patched in Latest Release https://securityonline.info/php-sql-injection-cve-2026-17543/
Post summary
The article indicates that the PHP SQL injection flaw CVE-2026-17543 has been patched in the latest release, with no evidence of active exploitation or proofs of concept.
0000089
180 followersView on X
Daily CyberSecurity@Daily_CyberSec89d
Patch
A PHP SQL injection flaw, CVE-2026-17543, was patched alongside two memory bugs. Update to PHP 8.2.33, 8.3.33, 8.4.24, or 8.5.9 now. #PHP #SQLInjection #CVE202617543 #PostgreSQL #Vulnerability #InfoSec http://securityonline.info/php-sql-injection-cve-2026-17543/
Post summary
CVE-2026-17543 is a PHP SQL injection vulnerability that has been patched in multiple PHP releases, and users should update to the stated versions to mitigate the issue.
00000433
12.6K followersView on X
Shinjae Kang@zemnanet90d
Patch
PHP 8.5.9 fixes CVE-2026-17543 in pgsql. A green Laravel deploy does not mean CI, workers, and prod hosts run the patched binary. After you ship 8.5.9, which surface still reports the old php -v? #php
Post summary
The update indicates that PHP 8.5.9 addresses CVE‑2026‑17543 in pgsql, but warns that deployed hosts may still run the old binary. No exploit or active use details are provided.
0000072
32 followersView on X
Damien Seguy (@[email protected])@faguo91d
General
@zemnanet do you have more details on CVE-2026-17543? it is still reserved at the moment.
Post summary
The provided text merely asks for additional information on CVE-2026-17543 and contains no explicit details, PoC, exploit, or mitigation information.
0000073
1.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	php	php	-	-	-

Explore more

Back to dashboard php CVEs php vulnerabilities

What researchers are saying

CVE-2026-17543

dbugs[verified]@ptdbugsPoC

A publicly available PoC and exploit script for CVE-2026-17543 has been released, revealing a SQL injection vulnerability in PHP, but no evidence of active exploitation or patch has been provided.

kokumօtօ[verified]@__kokumotoPatch

The post announces that the SQL injection vulnerability CVE-2026-17543 in PHP’s PostgreSQL adapters has been fixed, along with related CVEs, and provides technical details and a fix.

Shinjae Kang[verified]@zemnanetPatch

The post announces that PHP 8.5.9 patches CVE-2026-17543, a PHP-based SQL injection flaw, and urges checking deployment environments post-upgrade.

キタきつね[verified]@foxbookPatch

The post announces that CVE-2026-17543, a SQL injection vulnerability in PHP, has been patched in the latest release, with no proof of concept or active exploitation reported.

Shinjae Kang[verified]@zemnanetPatch

The update indicates that PHP 8.5.9 addresses CVE‑2026‑17543 in pgsql, but warns that deployed hosts may still run the old binary. No exploit or active use details are provided.

iototsecnews@iototsecnewsDisclosure

Three new PHP vulnerabilities (CVE‑2026‑17543, CVE‑2026‑17544, CVE‑2026‑7260) have been disclosed, exposing SQL injection, memory corruption, and server crashes; users should update to the latest release and validate input data.

takenaka hiroya@Joe_Biden_jaPatch

The author notes that two separate PHP CVEs fixed on the same release have different impact scopes—one affecting versions back to 8.2 and the other a regression in 8.4.3RC1—and shares a script‑generated output of their triage.

takenaka hiroya@Joe_Biden_jaDisclosure

The text announces a SQL injection vulnerability in PHP’s PostgreSQL extension with specific affected functions and provides patch versions.