PHP 8.2–8.5 Security Patches Land: What Developers Need to Update Now

Last updated: August 7, 2026

Image: cyberq.tw

Three CVEs landed on 3 August 2026. One of them is a SQL injection flaw in core PHP functions. If you’re running PHP 8.2 through 8.5 – on Pantheon or anywhere else – here is the one-sentence summary: check your version today and patch if you haven’t already.

On 3 August 2026, Pantheon announced the availability of PHP 8.2.33, 8.3.33, 8.4.24, and 8.5.9 across its platform. Three CVEs. A slate of bug fixes. The fixes matter beyond Pantheon – any self-hosted stack running affected versions needs the same treatment.

Who must act today

Image: cyberq.tw

Start here before reading anything else. Work out which bucket you’re in:

You use ext-pgsql on a self-hosted server. This is the highest-priority group. CVE-2026-17543 is live against your installation. You need to patch before the next deployment window.

You use BCMath for financial or scientific calculations on PHP 8.4 or 8.5. CVE-2026-17544 applies to you. Patch it.

You handle Phar archives – uploads, third-party packages, anything that unpacks .phar files. CVE-2026-7260 can crash your PHP process with a crafted archive. You’re exposed on any unpatched version.

You’re a Pantheon customer and you don’t fall into any of the above. You can breathe – Pantheon is rolling these updates out automatically. No manual action required.

Not sure which bucket you’re in? Keep reading. The audit commands are below.

What the vulnerabilities actually do

The headline issue is CVE-2026-17543: a high-severity SQL injection flaw buried inside PHP’s PostgreSQL extension, ext-pgsql. It affects four functions – pg_insert(), pg_update(), pg_select(), and pg_delete() – that developers often reach for as a lightweight alternative to a full ORM when working with PostgreSQL directly.

Think of those four functions like a helpful assistant who takes your shopping list and walks to the shops for you. The vulnerability means a malicious value slipped into that list could redirect the assistant to raid your neighbour’s house instead. Sanitisation that felt adequate yesterday may not be enough when the underlying driver has a flaw at this level. According to an HKCERT security bulletin covering the combined impact, the consequences span security restriction bypass, data manipulation, denial of service, and information disclosure – a fairly comprehensive list of things you do not want happening to a production database.

The second flaw, CVE-2026-17544, is an out-of-bounds write in BCMath’s bccomp() function. BCMath (Binary Calculator Math) is PHP’s arbitrary-precision arithmetic library – you use it when floating-point rounding errors would ruin a financial calculation. This CVE only affects PHP 8.4 and 8.5, but an out-of-bounds write is the kind of memory corruption bug that can escalate unpredictably under the right conditions. Nasty. Patch it.

Rounding out the trio is CVE-2026-7260: a crash triggered by recursive symlinks inside the Phar extension. Phar is PHP’s archive format, similar in concept to a JAR file in the Java world. A crafted archive with looping symlinks could bring your PHP process to its knees – denial of service without any database access required. PHP 8.4.24 and 8.5.9 also bundle an updated version of libgd (the image-processing library) to address CVE-2026-9672, which rounds out a tidy but consequential bundle of fixes.

How to audit whether you’re actually exposed

You might think you’d know if you were using ext-pgsql or Phar. You’d be surprised. Third-party packages can pull in extensions you never consciously chose.

Checking for ext-pgsql: Run php -m | grep pgsql on your server. If it returns pgsql, the extension is loaded. Then grep your codebase for the affected functions: grep -r "pg_insert\|pg_update\|pg_select\|pg_delete" src/. If you get hits, you’re using the vulnerable interface directly. If ext-pgsql is loaded but you’re not calling those functions yourself, check your Composer dependencies – run composer show --all | grep pgsql to see if a library is pulling it in.

Checking for Phar usage: Run php -m | grep Phar. Phar is enabled by default in most PHP builds, so the real question is whether your application processes untrusted archives. Search for Phar:: calls and phar:// stream wrappers: grep -r "Phar::\|phar://" src/. Composer itself uses Phar internally, but that’s trusted code – the risk is in user-supplied or third-party archive processing.

Checking your lockfile: Your composer.lock file pins the exact version of every dependency. If a dependency ships its own bundled Phar or uses ext-pgsql under the hood, the lockfile is where you’ll find it. A quick grep -i "pgsql\|bcmath" composer.lock surfaces anything that declared those extensions as requirements.

Do this audit before you decide how urgently to prioritise the patch. The results might surprise you.

Pantheon auto-update vs patching your own stack

Here is where the two groups diverge sharply, and where the trade-offs are honest rather than theoretical.

Pantheon customers: Updates roll out automatically. No deployment pipeline to trigger, no maintenance window to schedule. That is a genuine operational advantage. The flip side is that you do not control the timing, which matters if a patch ever – rarely – introduces a regression in your application. You swap manual effort for a small amount of trust. Fair deal for most teams.

Self-hosted developers: You own the timeline entirely. That is both freedom and responsibility.

The workflow splits by how you run PHP:

Package manager (apt, dnf, brew): Run sudo apt-get update && sudo apt-get upgrade php8.4 (adjust the version suffix to match your branch). Confirm with php --version afterwards – it should read 8.2.33, 8.3.33, 8.4.24, or 8.5.9 depending on your branch.

Docker containers: This is the one that catches teams out. Your running container won’t update itself. You need to pull a fresh base image – FROM php:8.4.24-fpm rather than php:8.4-fpm if you want a pinned version – rebuild the image, and redeploy. If your CI/CD pipeline caches the old image layer, it won’t pick up the patch automatically. Check your FROM line in every Dockerfile, and check whether your pipeline’s layer cache is pinned to a digest that predates the fix. Stale Docker layers are how teams convince themselves they’ve patched when they haven’t.

CI/CD lockfiles and image tags: If your pipeline pulls php:8.4-fpm (a floating tag), it will eventually get the patched image – but “eventually” is not a security posture. Pin to the specific digest of the patched image or use an exact version tag, and add a docker inspect step to your pipeline that asserts the PHP version matches your expected minimum. That way a stale cache can’t silently run vulnerable code. This is where the AI Coding Tools Broke Your CI/CD Pipeline guide becomes directly relevant if your tooling is adding friction here.

The perimeter of your API is only as strong as the runtime it sits on – a point REST API Security Best Practices in Production makes clearly, and that applies here whether you’re on managed hosting or self-hosted infrastructure.

Check this now

Skip the lengthy FAQ. Here is the short list:

• php --version – should show 8.2.33, 8.3.33, 8.4.24, or 8.5.9
• php -m | grep pgsql – if this returns anything, audit your pg_* function calls immediately
• php -m | grep Phar – if you process untrusted archives, you’re in scope for CVE-2026-7260
• grep -r "pg_insert\|pg_update\|pg_select\|pg_delete" src/ – confirms direct ext-pgsql exposure
• grep -i "pgsql\|bcmath" composer.lock – surfaces dependencies that may bring in affected extensions
• For Docker: check your FROM tag and verify the rebuilt image reports the correct PHP version with docker run --rm your-image php --version

If any of those checks surface a gap, you have the patch version and the method. The update is available. The path is clear. Ship it.

Source: https://docs.pantheon.io/release-notes/2026/08/php-82-83-84-85-security-updates