PHP 8.5.9 Fixes a Postgres SQL Injection and Three More CVEs

The PHP team shipped PHP 8.5.9 on July 30, 2026, and it's a security release. Four CVEs are patched, including a high severity SQL injection in the PostgreSQL extension that reaches back through every supported branch. PHP 8.4.24 went out the same day with the same set of fixes.

Here's what's in it:

SQL injection in the pgsql extension's pg_insert(), pg_update(), pg_select(), and pg_delete() (CVE-2026-17543)

Out-of-bounds write in BCMath's bccomp() (CVE-2026-17544)

Crash in Phar via recursive symlinks (CVE-2026-7260)

A libgd upgrade in the GD extension (CVE-2026-9672)

Tracing JIT crash fixes, plus a long list of bug fixes across Reflection, PDO_ODBC, URI, Date, Session, and SPL

Security Fixes#

SQL Injection in the PostgreSQL Extension#

This is the one to read. php_pgsql_convert() builds escape string constants in the E'...' form, and inside that form a backslash is an escape character. The problem is that PQescapeStringConn() doesn't escape backslashes when standard_conforming_strings is on, which has been the PostgreSQL default since 9.1. It escapes ' as '', so an attacker can walk out of the string with a trailing backslash and write their own SQL.

The affected functions are the array-to-SQL helpers in ext/pgsql: pg_insert(), pg_update(), pg_select(), and pg_delete(). If your app talks to Postgres through PDO, which is what Laravel's database layer uses, your queries don't go through this code path. It's still worth patching, since anything in your dependency tree that reaches for pg_* directly does.

The fix landed from ilutov and is out in 8.2.33, 8.3.33, 8.4.24, and 8.5.9.

Advisory: GHSA-7qpv-r5mr-78m4

Out-of-Bounds Write in bccomp() #

BCMath's bc_str2num() helper shortens its allocated string when a scale argument truncates trailing zeros, but it never adjusts the fractional_end pointer it copies with. The copy then runs past the end of the buffer and corrupts stack or heap memory depending on how BCMath allocated it. Reported by Recep Asan and fixed in 8.4.24 and 8.5.9.

Advisory: GHSA-x692-q9x7-8c3f

Phar and GD#

Jakub Zelenka fixed a crash in Phar triggered by recursive symlinks (CVE-2026-7260). The same release cleans up how Phar handles the magic .phar directory, so paths like /.phar stay protected while non-magic paths that merely start with .phar behave the same across file creation, copying, ArrayAccess, stream lookup, directory iteration, and extraction. GD picked up a libgd upgrade from Pierre Joye covering CVE-2026-9672.

Other Fixes Worth Noting#

Opcache got three JIT fixes, two of them crashes on megamorphic dynamic calls (GH-22158, GH-22443) and one infinite recursion in a property hook getter inside a preloaded trait (GH-21770).

Reflection had a cluster of __toString() bugs cleaned up, including output truncating on null bytes (GH-22681) and a spurious warning when converting NAN (GH-22683). ReflectionClass::hasProperty() and getProperty() also stopped ignoring dynamic properties that shadow a private parent property.

The URI extension that arrived in PHP 8.5 got three WHATWG corrections from Máté Kocsis, covering caret percent-encoding in paths, validation with an empty host and non-empty userinfo, and wither methods with empty opaque hosts. Elsewhere, PDO_ODBC picked up four memory safety fixes, array_multisort() no longer hits a use-after-free when the comparator mutates the array being sorted, base_convert() stopped capping output at 64 characters, and a session garbage collection difference between PHP 8.3 and 8.5 was tracked down and fixed.

Upgrade Notes#

No breaking changes and no new features, this is a patch release. Given the SQL injection and the BCMath memory corruption, treat it as one to schedule rather than one to batch. If you're on 8.4, the same CVEs are covered by 8.4.24, and 8.2.33 and 8.3.33 carry the Postgres fix for the older branches.

Worth pairing with a look at your own dependencies. composer audit checks an installed dependency tree against known PHP security advisories, and the PHP Foundation's security team has been coordinating a lot of this triage work.

References#

PHP 8.5 changelog

CVE-2026-17543, pgsql SQL injection

CVE-2026-17544, BCMath out-of-bounds write

Download PHP 8.5.9