Critical PHP SOAP Extension Flaw Enables Remote Code Execution Attacks - cyberpress.org

Critical PHP SOAP Extension Flaw Enables Remote Code Execution Attacks By AnuPriya May 11, 2026 Categories: Cyber Security NewsCybersecurityVulnerability Recently disclosed vulnerabilities in PHP, particularly within the widely used SOAP extension, have triggered significant alarms across the cybersecurity community. The most severe flaw allows threat actors to achieve Remote Code Execution (RCE) on affected servers. System administrators must apply patches immediately to protect their environments from potential exploitation. Historically, the PHP SOAP extension has been a prime target for attackers due to the complexity of XML processing. This complexity frequently introduces subtle memory management bugs that advanced threat actors can weaponize to compromise entire systems. PHP SOAP Extension Vulnerability The most critical newly published vulnerability is CVE-2026-6722, a high-severity Use-After-Free (UAF) flaw located in the ext-soap package. This issue originates from how the extension deduplicates objects in the XML graph using id and href attributes. During XML graph traversal, PHP stores plain objects in a hash map, but the object’s reference count is not properly incremented during this memory allocation. Attackers can exploit this missing reference increment by utilizing an Apache map mechanism to overwrite existing map entries and free objects prematurely. By carefully crafting an XML payload, an attacker forces a node to evaluate a stale object, which invalidates the pointer in the reference map. Once the memory is freed, the attacker can use the href attribute to point back to this stale memory. By allocating plain strings to the freed space, threat actors gain deep control over the memory segment. This level of memory manipulation creates a highly reliable pathway to Remote Code Execution, effectively bypassing standard memory protections. Researchers also discovered CVE-2026-7261, a moderate-severity UAF vulnerability tied to the SoapServer session persistence feature. Additionally, CVE-2026-7262 involves a NULL pointer dereference in the Apache Map decoder, creating a trivial vector for Denial-of-Service (DoS) attacks that require zero user interaction. Beyond the SOAP extension, two out-of-bounds read vulnerabilities (CVE-2026-7258 and CVE-2026-6104) were found in other PHP core functions, leading to potential information disclosure and memory corruption. These memory corruption and logic vulnerabilities affect a wide footprint of current PHP releases. The issues are present in PHP versions before 8.2.31, 8.3.31, 8.4.21, and 8.5.6. Any applications relying on the SOAP extension or processing untrusted inputs via URL decoding are at significant risk of exploitation. The PHP development team has addressed these flaws by enforcing stricter memory safety checks in their latest releases. For the high-severity SOAP vulnerability, developers proactively increased object reference counts before adding them to the global reference map to safely release objects. CVE ID Severity Weakness Attack Type Vector CVE-2026-6722 High CWE-416: Use-After-Free Remote Code Execution Network CVE-2026-7261 Moderate Use-After-Free Use-After-Free Network CVE-2026-7262 Moderate NULL pointer dereference Denial of Service (DoS) Network CVE-2026-7258 Moderate CWE-125: Out-of-bounds Read Out-of-bounds Read Network CVE-2026-6104 Moderate CWE-125: Out-of-bounds Read Information Disclosure Network System administrators and web hosts are strongly urged to upgrade their PHP installations to the patched versions immediately. The rapid discovery and remediation of these flaws highlight the collaborative effort across the open-source security community. Vulnerability reports were responsibly disclosed by security researchers BrettGervasoni, iliaal, xfourj, and AkshayJainG, with core patches developed by the PHP maintainer team. Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google Share Facebook Twitter Pinterest WhatsApp AnuPriya Any Priya is a cybersecurity reporter at Cyber Press, specializing in cyber attacks, dark web monitoring, data breaches, vulnerabilities, and malware. She delivers in-depth analysis on emerging threats and digital security trends. Recent Articles Weaponized JPEG Images Could Enable Exploitation of PHP Memory Flaws Cyber Security News May 16, 2026 Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address Android May 15, 2026 VMware Fusion Vulnerability Lets Attackers Escalate Privileges to Root Cyber Security News May 15, 2026 Google Project Zero Reveals Zero-Click Exploit Chain for Pixel 10 Cyber Security News May 15, 2026 PraisonAI Vulnerability Exploited Hours After Public Disclosure Cyber Security News May 15, 2026 Related Stories Cyber Security News Weaponized JPEG Images Could Enable Exploitation of PHP Memory Flaws Divya - May 16, 2026 Android Android 16 VPN Bypass Lets Apps Reveal Users’ Real IP Address AnuPriya - May 15, 2026 Cyber Security News VMware Fusion Vulnerability Lets Attackers Escalate Privileges to Root AnuPriya - May 15, 2026 Cyber Security News Google Project Zero Reveals Zero-Click Exploit Chain for Pixel 10 AnuPriya - May 15, 2026 Cyber Security News PraisonAI Vulnerability Exploited Hours After Public Disclosure AnuPriya - May 15, 2026 Cyber Security News Microsoft Edge, Windows 11, and LiteLLM Hacked at Pwn2Own Berlin 2026 AnuPriya - May 15, 2026 LEAVE A REPLY Comment: Name:* Email:* Website: