[{"data":1,"prerenderedAt":729},["ShallowReactive",2],{"switcher-blog-pareja":3,"art-php-8-5-9-postgresql-sql-injection-en":6},{"en":4,"es":5},"\u002Fen\u002Fblog\u002Fphp-8-5-9-postgresql-sql-injection\u002F","\u002Fes\u002Fblog\u002Fphp-8-5-9-inyeccion-sql-postgresql\u002F",{"id":7,"title":8,"author":9,"body":10,"date":714,"description":715,"extension":716,"image":717,"meta":718,"navigation":420,"pareja":719,"path":720,"seo":721,"sin_cta":722,"stem":723,"tags":724,"__hash__":728},"blogEn\u002Fen\u002Fblog\u002Fphp-8-5-9-postgresql-sql-injection.md","PHP patches a PostgreSQL SQL injection: CVE-2026-17543 and four branches updated at once","Paco Cubel",{"type":11,"value":12,"toc":690},"minimark",[13,18,32,45,49,83,86,90,98,109,124,146,153,167,170,177,188,195,199,214,218,221,224,228,284,288,292,314,317,378,382,444,447,451,540,550,554,576,586,590,600,603,607,641,644,648,686],[14,15,17],"h2",{"id":16},"four-branches-patched-on-the-same-day-that-tells-you-something","Four branches patched on the same day: that tells you something",[19,20,21,22,26,27,31],"p",{},"On 30 July PHP shipped ",[23,24,25],"strong",{},"8.5.9, 8.4.24, 8.3.33 and 8.2.33"," — all four at once, all four tagged as a ",[28,29,30],"em",{},"security release",". When the PHP team pushes the same batch simultaneously across every supported branch, it isn't for fun: the flaw sits in shared code and reaches all the way back to the oldest version they still maintain.",[19,33,34,35,40,41,44],{},"Three weeks ago we wrote about ",[36,37,39],"a",{"href":38},"\u002Fen\u002Fblog\u002Fphp-8-5-8-security-patches","8.5.8 and 8.4.23",", and that was a quiet round. This one has real meat: there's an ",[23,42,43],{},"SQL injection CVE",". That said, before anyone panics, the honest answer to \"does this hit me?\" depends a lot on which database you run.",[14,46,48],{"id":47},"in-one-sentence","In one sentence",[19,50,51,52,60,61,67,68,74,75,78,79,82],{},"Five CVEs get closed: an ",[23,53,54,55,59],{},"SQL injection in the ",[56,57,58],"code",{},"pgsql"," extension"," (CVE-2026-17543), an ",[23,62,63,64],{},"out-of-bounds write in BCMath's ",[56,65,66],{},"bccomp()"," (CVE-2026-17544), the ",[23,69,70,71],{},"memory corruption in ",[56,72,73],{},"openssl_encrypt"," we already knew about, finally landing on the 8.5 branch (CVE-2026-14355), a ",[23,76,77],{},"Phar crash via recursive symlinks"," (CVE-2026-7260) and a ",[23,80,81],{},"libgd upgrade"," (CVE-2026-9672). Thrown in for free: four memory bugs in PDO_ODBC with no CVE assigned.",[19,84,85],{},"If you work with PostgreSQL, stop reading, update, come back. If you're on MySQL or MariaDB — most people — the headline doesn't apply to you, but BCMath probably does.",[14,87,89],{"id":88},"the-flaws-ordered-by-what-you-should-look-at-first","The flaws, ordered by what you should look at first",[91,92,94,95,97],"h3",{"id":93},"_1-sql-injection-in-pgsql-cve-2026-17543","1. SQL injection in ",[56,96,58],{}," (CVE-2026-17543)",[19,99,100,101,108],{},"This is the headline of the batch. The security advisory describes it as an ",[28,102,103,104,107],{},"SQL injection via ",[56,105,106],{},"E'...'"," backslash breakout",".",[19,110,111,112,115,116,119,120,123],{},"In plain terms: PostgreSQL has a special kind of string literal, the one written ",[56,113,114],{},"E'text'",", where ",[23,117,118],{},"the backslash is treated as an escape character"," rather than an ordinary character. PHP's escaping wasn't accounting for that properly, so a crafted input could ",[23,121,122],{},"break out of the quotes"," and smuggle its own SQL into the query.",[19,125,126,127,129,130,133,134,137,138,141,142,145],{},"It hits you if your application talks to PostgreSQL through the ",[56,128,58],{}," extension and builds queries by escaping values rather than using genuinely parameterised prepared statements. If you do use real prepared statements — ",[56,131,132],{},"$1",", ",[56,135,136],{},"$2"," parameters, not concatenation in disguise — the attack gets a lot harder, but ",[23,139,140],{},"update anyway",": auditing every corner of your codebase to save yourself one ",[56,143,144],{},"apt install"," is a bad trade.",[91,147,149,150,152],{"id":148},"_2-out-of-bounds-write-in-bccomp-cve-2026-17544","2. Out-of-bounds write in ",[56,151,66],{}," (CVE-2026-17544)",[19,154,155,156,159,160,162,163,166],{},"BCMath is the arbitrary-precision arithmetic extension, the one you use so floating-point decimals don't quietly eat your cents. Which means ",[23,157,158],{},"anything handling money seriously"," pushes numbers through it. ",[56,161,66],{}," compares two of those numbers, and this patch closes an ",[23,164,165],{},"out-of-bounds write"," in it.",[19,168,169],{},"This is the one that touches the most shops and billing systems we manage, and it's why this round isn't optional even if you never go near PostgreSQL.",[91,171,173,174,176],{"id":172},"_3-openssl_encrypt-with-aes-wrap-pad-the-one-weve-been-carrying-cve-2026-14355","3. ",[56,175,73],{}," with AES-WRAP-PAD: the one we've been carrying (CVE-2026-14355)",[19,178,179,180,183,184,187],{},"We covered this one on 6 July, when it was fixed in ",[23,181,182],{},"8.4.23",". What we didn't say back then — because nobody knew — is that ",[23,185,186],{},"the 8.5 branch was left out of that patch",". It's fixed now, in 8.5.9, and it finally has a CVE number.",[19,189,190,191,194],{},"The lesson is worth more than the bug itself: ",[23,192,193],{},"a newer branch does not automatically mean a better-patched one",". If you moved to 8.5.8 in July thinking you were ahead of whoever was sitting on 8.4.23, on this specific flaw you were behind. It's still an uncommon cipher mode (key wrapping, not everyday encryption), so most setups never trigger it.",[91,196,198],{"id":197},"_4-phar-recursive-symlinks-cve-2026-7260-and-libgd-cve-2026-9672","4. Phar recursive symlinks (CVE-2026-7260) and libgd (CVE-2026-9672)",[19,200,201,202,205,206,209,210,213],{},"The two closers. The ",[23,203,204],{},"Phar"," one causes a crash via recursive symlinks: the process dies, no code execution. It matters if you manipulate ",[56,207,208],{},".phar"," archives or load code packaged in that format. The ",[23,211,212],{},"libgd"," one arrives through an upgrade of the library sitting under the GD extension — the one half the internet and every CMS uses to resize user-uploaded images. If your site lets people upload photos, you are running that code.",[91,215,217],{"id":216},"_5-pdo_odbc-four-memory-bugs-no-cve","5. PDO_ODBC: four memory bugs, no CVE",[19,219,220],{},"No CVE numbers, but they don't read well: a heap buffer over-read when a column value exceeds the driver-reported display size, a heap buffer overflow when an output parameter is longer than its declared maxlen, an out-of-bounds write when the driver reports a diagnostic message longer than the error buffer, and a crash with connection pooling when the DSN carries no credentials.",[19,222,223],{},"On a typical web server you never come near any of this. If you have PHP talking over ODBC to a SQL Server or a legacy AS\u002F400, you already know you do — and these four are yours.",[14,225,227],{"id":226},"whos-affected","Who's affected",[229,230,231,249,266,278],"ul",{},[232,233,234,237,238,241,242,244,245,248],"li",{},[23,235,236],{},"High priority",": anyone on ",[23,239,240],{},"PostgreSQL"," using the ",[56,243,58],{}," extension (CVE-2026-17543), and anyone moving money through ",[23,246,247],{},"BCMath"," (CVE-2026-17544).",[232,250,251,254,255,258,259,261,262,265],{},[23,252,253],{},"Medium priority",": anyone on the ",[23,256,257],{},"8.5 branch"," using ",[56,260,73],{}," for key wrapping — the patch 8.4 got three weeks ago and 8.5 didn't — and any site accepting ",[23,263,264],{},"image uploads"," (libgd).",[232,267,268,271,272,274,275,108],{},[23,269,270],{},"Specific cases",": applications that manipulate ",[23,273,204],{}," archives and those connecting over ",[23,276,277],{},"ODBC",[232,279,280,283],{},[23,281,282],{},"Everyone else",": there's no exploit loose on the internet aiming at your server this week, but that's four branches patched on the same day and a ten-minute update. There's no sensible excuse for pushing it to September.",[14,285,287],{"id":286},"what-to-do-today","What to do today",[91,289,291],{"id":290},"_1-check-which-version-you-have","1. Check which version you have",[293,294,299],"pre",{"className":295,"code":296,"language":297,"meta":298,"style":298},"language-bash shiki shiki-themes github-dark-high-contrast","php -v\n","bash","",[56,300,301],{"__ignoreMap":298},[302,303,306,310],"span",{"class":304,"line":305},"line",1,[302,307,309],{"class":308},"s_sBn","php",[302,311,313],{"class":312},"sCcAr"," -v\n",[19,315,316],{},"Targets, by branch:",[318,319,320,333],"table",{},[321,322,323],"thead",{},[324,325,326,330],"tr",{},[327,328,329],"th",{},"Branch",[327,331,332],{},"Target version",[334,335,336,348,358,368],"tbody",{},[324,337,338,342],{},[339,340,341],"td",{},"8.5",[339,343,344,347],{},[23,345,346],{},"8.5.9"," or newer",[324,349,350,353],{},[339,351,352],{},"8.4",[339,354,355,347],{},[23,356,357],{},"8.4.24",[324,359,360,363],{},[339,361,362],{},"8.3",[339,364,365,347],{},[23,366,367],{},"8.3.33",[324,369,370,373],{},[339,371,372],{},"8.2",[339,374,375,347],{},[23,376,377],{},"8.2.33",[91,379,381],{"id":380},"_2-check-whether-the-big-one-applies-to-you","2. Check whether the big one applies to you",[293,383,385],{"className":295,"code":384,"language":297,"meta":298,"style":298},"# Is the PostgreSQL extension loaded?\nphp -m | grep -i pgsql\n\n# What about BCMath?\nphp -m | grep -i bcmath\n",[56,386,387,393,415,422,428],{"__ignoreMap":298},[302,388,389],{"class":304,"line":305},[302,390,392],{"class":391},"sQrFR","# Is the PostgreSQL extension loaded?\n",[302,394,396,398,401,405,408,411],{"class":304,"line":395},2,[302,397,309],{"class":308},[302,399,400],{"class":312}," -m",[302,402,404],{"class":403},"sWyjQ"," |",[302,406,407],{"class":308}," grep",[302,409,410],{"class":312}," -i",[302,412,414],{"class":413},"sTRMh"," pgsql\n",[302,416,418],{"class":304,"line":417},3,[302,419,421],{"emptyLinePlaceholder":420},true,"\n",[302,423,425],{"class":304,"line":424},4,[302,426,427],{"class":391},"# What about BCMath?\n",[302,429,431,433,435,437,439,441],{"class":304,"line":430},5,[302,432,309],{"class":308},[302,434,400],{"class":312},[302,436,404],{"class":403},[302,438,407],{"class":308},[302,440,410],{"class":312},[302,442,443],{"class":413}," bcmath\n",[19,445,446],{},"If the first one returns anything, the SQL injection is your problem and this just became urgent.",[91,448,450],{"id":449},"_3-update-and-reload-php-fpm-no-downtime","3. Update and reload PHP-FPM (no downtime)",[293,452,454],{"className":295,"code":453,"language":297,"meta":298,"style":298},"# Debian \u002F Ubuntu (Ondřej Surý's repository)\nsudo apt update && sudo apt install --only-upgrade php8.5 php8.5-fpm\nsudo systemctl reload php8.5-fpm\n\n# RHEL \u002F AlmaLinux \u002F Rocky (Remi repository)\nsudo dnf update php php-fpm\nsudo systemctl reload php-fpm\n",[56,455,456,461,492,504,508,513,529],{"__ignoreMap":298},[302,457,458],{"class":304,"line":305},[302,459,460],{"class":391},"# Debian \u002F Ubuntu (Ondřej Surý's repository)\n",[302,462,463,466,469,472,476,478,480,483,486,489],{"class":304,"line":395},[302,464,465],{"class":308},"sudo",[302,467,468],{"class":413}," apt",[302,470,471],{"class":413}," update",[302,473,475],{"class":474},"sMAXC"," && ",[302,477,465],{"class":308},[302,479,468],{"class":413},[302,481,482],{"class":413}," install",[302,484,485],{"class":312}," --only-upgrade",[302,487,488],{"class":413}," php8.5",[302,490,491],{"class":413}," php8.5-fpm\n",[302,493,494,496,499,502],{"class":304,"line":417},[302,495,465],{"class":308},[302,497,498],{"class":413}," systemctl",[302,500,501],{"class":413}," reload",[302,503,491],{"class":413},[302,505,506],{"class":304,"line":424},[302,507,421],{"emptyLinePlaceholder":420},[302,509,510],{"class":304,"line":430},[302,511,512],{"class":391},"# RHEL \u002F AlmaLinux \u002F Rocky (Remi repository)\n",[302,514,516,518,521,523,526],{"class":304,"line":515},6,[302,517,465],{"class":308},[302,519,520],{"class":413}," dnf",[302,522,471],{"class":413},[302,524,525],{"class":413}," php",[302,527,528],{"class":413}," php-fpm\n",[302,530,532,534,536,538],{"class":304,"line":531},7,[302,533,465],{"class":308},[302,535,498],{"class":413},[302,537,501],{"class":413},[302,539,528],{"class":413},[19,541,542,543,133,546,549],{},"Reloading PHP-FPM swaps in the new binary without cutting in-flight requests. Adjust the version number (",[56,544,545],{},"php8.5",[56,547,548],{},"php8.4","…) to whatever you have installed.",[91,551,553],{"id":552},"_4-confirm-it-stuck","4. Confirm it stuck",[293,555,557],{"className":295,"code":556,"language":297,"meta":298,"style":298},"php -v\nphp-fpm8.5 -v   # or php-fpm -v depending on your distro\n",[56,558,559,565],{"__ignoreMap":298},[302,560,561,563],{"class":304,"line":305},[302,562,309],{"class":308},[302,564,313],{"class":312},[302,566,567,570,573],{"class":304,"line":395},[302,568,569],{"class":308},"php-fpm8.5",[302,571,572],{"class":312}," -v",[302,574,575],{"class":391},"   # or php-fpm -v depending on your distro\n",[577,578,579],"blockquote",{},[19,580,581,582,585],{},"As always with distributions: sometimes they backport the fix while keeping a different version number. ",[23,583,584],{},"Don't trust the number alone, check the package date"," or your distro's security changelog. \"It's updated\" is something you verify, not something you remember.",[14,587,589],{"id":588},"what-we-do","What we do",[19,591,592,593,596,597,599],{},"When a batch like this lands, the first move isn't to update everything blindly — it's to ",[23,594,595],{},"cross-reference the flaw against what's actually installed",". We pull out which servers have ",[56,598,58],{}," loaded, which ones expose an internet-facing application and which ones have billing running through BCMath, and those go first, today. The rest joins the normal update round for the week.",[19,601,602],{},"That list — which extensions each server loads, which version it runs, when it was last patched — is what turns a five-CVE batch into a ten-minute chore instead of an afternoon of surprises. Keeping it current is worth more than chasing every point release.",[14,604,606],{"id":605},"the-same-old-routine","The same old routine",[229,608,609,615,621,631,636],{},[232,610,611,614],{},[56,612,613],{},"php -v"," to know where you stand.",[232,616,617,620],{},[56,618,619],{},"php -m"," to know which extensions you actually load.",[232,622,623,626,627,630],{},[56,624,625],{},"apt","\u002F",[56,628,629],{},"dnf update"," of PHP and PHP-FPM.",[232,632,633,108],{},[56,634,635],{},"systemctl reload php*-fpm",[232,637,638,640],{},[56,639,613],{}," again to confirm.",[19,642,643],{},"If your PHP hasn't seen a patch in months, or you're not sure which extensions each server you manage is loading, this is a good moment to check. And if you'd rather we handled it, let's talk.",[14,645,647],{"id":646},"references","References",[229,649,650,658,665,672,679],{},[232,651,652],{},[36,653,657],{"href":654,"rel":655},"https:\u002F\u002Fwww.php.net\u002FChangeLog-8.php",[656],"nofollow","PHP.net — ChangeLog for the 8 branch",[232,659,660],{},[36,661,664],{"href":662,"rel":663},"https:\u002F\u002Fwww.php.net\u002Fdownloads.php",[656],"PHP.net — Downloads",[232,666,667],{},[36,668,671],{"href":669,"rel":670},"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-7qpv-r5mr-78m4",[656],"GHSA-7qpv-r5mr-78m4 — SQL injection in pgsql",[232,673,674],{},[36,675,678],{"href":676,"rel":677},"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-x692-q9x7-8c3f",[656],"GHSA-x692-q9x7-8c3f — Out-of-bounds write in bccomp()",[232,680,681],{},[36,682,685],{"href":683,"rel":684},"https:\u002F\u002Fgithub.com\u002Fphp\u002Fphp-src\u002Fsecurity\u002Fadvisories\u002FGHSA-vc5h-9ppw-p5f3",[656],"GHSA-vc5h-9ppw-p5f3 — Phar crash via recursive symlinks",[687,688,689],"style",{},"html pre.shiki code .s_sBn, html code.shiki .s_sBn{--shiki-default:#FFB757}html pre.shiki code .sCcAr, html code.shiki .sCcAr{--shiki-default:#91CBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sQrFR, html code.shiki .sQrFR{--shiki-default:#BDC4CC}html pre.shiki code .sWyjQ, html code.shiki .sWyjQ{--shiki-default:#FF9492}html pre.shiki code .sTRMh, html code.shiki .sTRMh{--shiki-default:#ADDCFF}html pre.shiki code .sMAXC, html code.shiki .sMAXC{--shiki-default:#F0F3F6}",{"title":298,"searchDepth":395,"depth":395,"links":691},[692,693,694,704,705,711,712,713],{"id":16,"depth":395,"text":17},{"id":47,"depth":395,"text":48},{"id":88,"depth":395,"text":89,"children":695},[696,698,700,702,703],{"id":93,"depth":417,"text":697},"1. SQL injection in pgsql (CVE-2026-17543)",{"id":148,"depth":417,"text":699},"2. Out-of-bounds write in bccomp() (CVE-2026-17544)",{"id":172,"depth":417,"text":701},"3. openssl_encrypt with AES-WRAP-PAD: the one we've been carrying (CVE-2026-14355)",{"id":197,"depth":417,"text":198},{"id":216,"depth":417,"text":217},{"id":226,"depth":395,"text":227},{"id":286,"depth":395,"text":287,"children":706},[707,708,709,710],{"id":290,"depth":417,"text":291},{"id":380,"depth":417,"text":381},{"id":449,"depth":417,"text":450},{"id":552,"depth":417,"text":553},{"id":588,"depth":395,"text":589},{"id":605,"depth":395,"text":606},{"id":646,"depth":395,"text":647},"2026-07-31","PHP ships 8.5.9, 8.4.24, 8.3.33 and 8.2.33 on the same day. There's an SQL injection in the pgsql extension, an out-of-bounds write in bccomp() and, finally, the openssl_encrypt fix for the 8.5 branch. Here's which one hits you, depending on what you run.","md","\u002Fog\u002Fog-default.png",{},"php-8-5-9-inyeccion-sql-postgresql","\u002Fen\u002Fblog\u002Fphp-8-5-9-postgresql-sql-injection",{"title":8,"description":715},false,"en\u002Fblog\u002Fphp-8-5-9-postgresql-sql-injection",[725,726,727],"PHP","Security","Servers","FV7Wd4uHrbdGc_rklIUq224AM65a8A1enZe7XiMWQBA",1787312492805]