PHP Patches Two Critical Bugs in Consecutive Security Releases
PHP released PHP 8.3.33 on July 28 and PHP 8.4.24 yesterday, a pair of security-only updates that address critical PostgreSQL SQL injection vectors, memory corruption in BCMath, and crash vectors in the Phar extension. There are no new features. Just patches.
The PHP team has been treating patch days like clockwork lately. After dropping PHP 8.6.0 Alpha 3 and several other maintenance builds yesterday, they pivoted straight to security fixes. PHP 8.3.33 is tagged by Eric Mann. PHP 8.4.24 is handled by Calvin Buckley, also known as NattyNarwhal. Both commits are GPG-verified on the php/php-src repository. The changelogs are deliberately dry. If you are running either branch, upgrading is no longer optional.
What actually broke
The headline vulnerability is CVE-2026-17543, a critical SQL injection in the PGSQL and PDO_PGSQL extensions. The flaw lives in the E'...' backslash breakout. If your application takes user input and interpolates it directly into PostgreSQL string literals using that syntax, an attacker can slip past escape sequences like \x00 and \n. Parameterized queries were the fix all along, but legacy codebases that still bake raw input into queries are sitting on a powder keg until you update.
PHP 8.4 also takes a hit for BCMath. CVE-2026-17544 is an out-of-bounds write triggered by bccomp(). Crafted arbitrary-precision math input can corrupt memory. Any project that lets untrusted values flow into BcMath's comparison functions needs a patch immediately.
The Phar extension gets a crash patch for CVE-2026-7260. Recursive symbolic links inside a .phar archive will take down the stream handler. It is high severity, though realistically a denial-of-service play unless you are doing something unusually malicious. libgd gets bumped upstream to address graphic processing issues (CVE-2026-9672), which lands in both releases.
For what it is worth, the PGSQL and Phar issues are not new to the community. We saw near-identical escape breakout headaches pop up in libpq back in 2024, and the Phar symlink recursion has been a known stream handler quirk for years. The PHP team's decision to patch both in the same twenty-four-hour window makes sense. The blast radius overlaps too heavily to split them across separate release cycles.
The rest of the 8.4 patch notes
While 8.3.33 is strictly a security sweep, 8.4.24 quietly sneaks in over twenty bug fixes. Integer overflows in gregoriantojd() and juliantojd() break when you hit INT_MAX. The DBA flatfile handler gets an out-of-bounds read fix for malformed length fields. Serialization risks pop up in DOM when you pass deeply nested XML documents to it. Even array_multisort() finally gets a use-after-free patch for when your comparator mutates the array mid-sort.
ODBC and PDO_ODBC land heap over-reads and connection pooling crashes in the same batch. Reflection classes truncate on embedded null bytes. Streams share resources across distinct abstract unix domain sockets because of null byte truncation. It is not glamorous work, but exactly what keeps the platform from quietly breaking under load.
php-8.3.33
Tag for php-8.3.33
php-8.4.24
Tag for php-8.4.24
