critical CVSS 9.8

CVE-2026-7261·PHP vulnerability

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.

Severity
critical
Software
PHP
Fixed in
8.5.6
Published
2026-05-10

Affected versions

From: 8.5.0

Until: 8.5.6

Fixed in: 8.5.6

How to fix this CVE

Update PHP to version 8.5.6 or later immediately to resolve a critical use-after-free vulnerability in the SOAP extension when session persistence is enabled. Organizations running PHP 8.2.x, 8.3.x, 8.4.x, or 8.5.x versions prior to the patched releases should prioritize this update, as the vulnerability can result in memory corruption, information leaks, or denial of service.

sudo dnf update php

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check the installed PHP version by running: php -v
  2. Step 2: Verify if SOAP persistence is enabled by searching php.ini for 'session.serialize_handler' and checking SoapServer configurations in application code for 'SOAP_PERSISTENCE_SESSION'
  3. Step 3: Monitor Apache/Nginx access logs and PHP error logs for patterns like 'Segmentation fault', 'memory corruption', or repeated 'SOAP' request failures followed by process crashes
  4. Step 4: After applying updates, confirm the patched version is active by running: php -v and verify no PHP-FPM process crashes occur during SOAP request handling

FAQ

What is CVE-2026-7261?

A critical use-after-free vulnerability in PHP's SOAP extension that occurs when session persistence is enabled and SOAP requests fail, allowing attackers to trigger memory corruption or information disclosure through crafted SOAP messages.

Is CVE-2026-7261 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog and no public exploits have been disclosed.

What versions of PHP are affected by CVE-2026-7261?

PHP 8.2.x before 8.2.31, 8.3.x before 8.3.31, 8.4.x before 8.4.21, and 8.5.x before 8.5.6 are all affected.

How do I check if my server is vulnerable to CVE-2026-7261?

Run 'php -v' and if your version falls within the vulnerable ranges (8.2.0-8.2.30, 8.3.0-8.3.30, 8.4.0-8.4.20, or 8.5.0-8.5.5), your system is vulnerable. Additionally confirm SoapServer is loaded with 'php -m | grep soap'.

Does Defensia detect CVE-2026-7261?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHP is installed on a monitored server, CVE-2026-7261 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-7261. Free for 1 server.

Get started free