CVE-2026-6722

What it actually does

This is a use-after-free vulnerability in PHP's SOAP extension. When parsing crafted SOAP XML containing an apache:Map node with duplicate keys, PHP can free an object while a stale pointer to that object remains reachable through the SOAP object-deduplication map. A later href reference can cause PHP to reuse that dangling pointer. If an attacker can influence heap layout through controlled string allocations, the freed memory may be reclaimed with attacker-controlled data, potentially leading to arbitrary code execution in the PHP process. The vulnerable code path is reachable remotely through SOAP request bodies handled by PHP SoapServer when the SOAP extension is enabled.

Why it matters to the business

Successful exploitation could allow an unauthenticated remote attacker to take control of a web application process, read or modify application data, deploy web shells, steal credentials or secrets accessible to PHP, pivot to adjacent systems, or disrupt service. Although this issue is not currently listed in CISA KEV, has no known ransomware association, and has low EPSS at this time, the technical severity is high because PHP is widely deployed and vulnerable SOAP endpoints may be internet-facing. Organizations running PHP SOAP services on affected versions should treat this as a priority patching item, especially where SOAP endpoints process untrusted requests.

How an attack unfolds

An attacker first identifies a PHP application exposing a SOAP endpoint backed by the PHP SOAP extension. The attacker sends a specially crafted SOAP request containing an apache:Map structure with duplicate keys and references that exercise PHP's object deduplication logic. During parsing, the duplicate key handling causes one PHP object to be freed while a stale pointer remains in an internal map. The attacker then causes a later href reference to use the stale pointer and attempts to shape PHP heap allocations so that controlled string data occupies the freed memory. If the memory layout is successfully manipulated, the PHP worker may dereference attacker-controlled data, which can result in remote code execution under the privileges of the web server or PHP-FPM process. Failed attempts may appear as PHP, Apache, or PHP-FPM crashes before reliable code execution is achieved.

How to fix it

Upgrade PHP to a fixed version for the active branch in use: PHP 8.2.31 or later, PHP 8.3.31 or later, PHP 8.4.21 or later, or PHP 8.5.6 or later. Apply vendor or distribution packages that include the backported fix if using an operating-system-maintained PHP build. If immediate patching is not possible, reduce exposure by disabling the SOAP extension where it is not required, removing or restricting unauthenticated SOAP endpoints, requiring authentication and network allowlisting for SOAP interfaces, and deploying WAF or reverse-proxy controls to block suspicious SOAP bodies containing apache:Map structures with duplicate keys and href references. Restart PHP-FPM, Apache, or other PHP application workers after patching to ensure vulnerable code is no longer resident in memory.

How to confirm the fix worked

Confirm the PHP runtime version with php -v and verify it is at or above the fixed version for the deployed branch. Confirm whether the SOAP extension is enabled with php -m, php -i, package inventory, or container image inspection. Identify exposed SOAP endpoints by reviewing application routes, WSDL URLs, web server configuration, and external attack-surface scans. Validate that patched PHP packages are actually loaded by the running web server or PHP-FPM pool, not merely installed side-by-side. After mitigation, test that legitimate SOAP functionality still works and that unauthenticated or untrusted clients cannot submit SOAP XML to vulnerable endpoints. Where WAF mitigations are used, test that requests containing apache:Map with duplicate keys and href-style references are rejected or logged.

Typical attack path

1. Discover an internet-accessible SOAP endpoint implemented by PHP SoapServer or otherwise using the PHP SOAP extension.
2. Confirm the target is likely running a vulnerable PHP branch: 8.2 before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21, or 8.5 before 8.5.6.
3. Send crafted SOAP XML containing apache:Map data with duplicate keys and href references to trigger the vulnerable object-deduplication behavior.
4. Use repeated requests and heap-shaping input to increase the chance that freed PHP object memory is reallocated with attacker-controlled content.
5. Achieve code execution in the PHP runtime context, or cause worker crashes during unsuccessful attempts.
6. Establish persistence or post-exploitation access, such as writing a web shell, launching child processes, stealing configuration secrets, or moving laterally using credentials available to the application.

How to detect it

To determine whether exploitation was attempted or successful, review HTTP access logs, reverse-proxy logs, WAF logs, packet captures, PHP error logs, Apache or Nginx logs, PHP-FPM logs, system logs, EDR telemetry, and file-integrity monitoring. Look for POST requests to SOAP or WSDL-related endpoints with XML bodies containing apache:Map, duplicate map keys, id attributes, and href references. Failed exploitation may produce worker crashes, segmentation faults, core dumps, abnormal PHP-FPM child exits, or web server 500 responses correlated with SOAP requests. Successful exploitation may be followed by unexpected child processes spawned by php-fpm, apache2, or httpd; suspicious outbound connections; new or modified PHP files in web-accessible directories; credential or configuration file access; or web shell behavior. No named threat actors or known exploitation campaigns are provided for this vulnerability, so detection should focus on protocol-level anomalies, process behavior, and post-exploitation indicators rather than actor-specific infrastructure.

• apache:Map
• href=
• SOAP-ENV:Envelope
• Content-Type: text/xml
• Content-Type: application/soap+xml
• POST /soap
• POST /wsdl
• ?wsdl
• Segmentation fault
• exit signal Segmentation fault (11)
• child exited on signal 11
• zend_mm_heap corrupted
• malloc(): memory corruption
• free(): invalid pointer
• php-fpm: pool
• php-fpm child exited
• core dumped
• /var/lib/systemd/coredump/
• /var/crash/
• /tmp/.php
• /tmp/php
• /var/www/html/shell.php
• /var/www/html/.
• /bin/sh -c
• php-fpm spawned /bin/sh
• apache2 spawned /bin/sh
• httpd spawned /bin/sh
• wget http
• curl http
• nc -e
• bash -i

What your security team should do

• Inventory all PHP deployments, including containers, appliance images, CI-built images, and distribution-packaged PHP runtimes, for vulnerable 8.2, 8.3, 8.4, and 8.5 versions.
• Prioritize patching internet-facing systems, systems exposing SOAP endpoints, and applications where the SOAP extension is enabled.
• Upgrade to PHP 8.2.31, 8.3.31, 8.4.21, 8.5.6, or later, or apply equivalent vendor backports.
• Disable the PHP SOAP extension on systems that do not explicitly require it.
• Restrict SOAP endpoints to trusted networks or authenticated clients; avoid exposing legacy SOAP interfaces directly to the internet.
• Add temporary WAF or reverse-proxy detections for SOAP requests containing apache:Map, duplicate key patterns, id/href references, and anomalous XML object graphs.
• Review historical web, WAF, PHP, and EDR logs for suspicious SOAP parsing crashes, repeated malformed SOAP requests, and unexpected child processes launched by PHP workers.
• Monitor for post-exploitation artifacts such as new web-accessible PHP files, suspicious command execution from php-fpm/httpd/apache2, outbound callbacks, and credential access.
• Because exploit maturity is currently reported as none and EPSS is low, balance urgency with exposure: patch broadly, but accelerate remediation for reachable SOAP services.