CVE-2026-7258

What it actually does

This vulnerability is a denial-of-service flaw in PHP caused by passing signed char values into ctype-style functions such as isxdigit() during URL decoding and related parsing operations. On platforms where char is signed by default and ctype implementations use optimized table lookups, notably NetBSD-like environments, malformed input containing byte values that become negative can cause an out-of-bounds array lookup. The expected impact is process instability or a crash of the PHP runtime or PHP-handling worker, resulting in reduced service availability rather than data theft or code execution.

Why it matters to the business

An unauthenticated remote attacker may be able to crash PHP-backed web application processes by sending specially crafted requests, causing intermittent outages, degraded web service performance, failed transactions, and operational disruption. The risk is highest for internet-facing PHP applications running affected PHP versions on platforms with signed char behavior and vulnerable ctype implementations. Although EPSS is currently low and no known exploited-in-the-wild status is reported, the vulnerability has been public for over 90 days and affects a widely deployed runtime, so exposed services should still be updated during normal patch cycles, with priority for externally reachable systems.

How an attack unfolds

An attacker identifies a web application or API endpoint handled by an affected PHP runtime. They then send crafted URL-encoded input containing byte values that, when processed by functions such as urldecode(), are passed as signed negative char values into ctype functions such as isxdigit(). On susceptible operating systems and compiler/runtime combinations, the ctype implementation may use the negative value as an array index, causing an invalid memory access. If the malformed request reaches vulnerable parsing code, the PHP process or worker handling the request may crash, leading to denial of service. Repeated requests can produce recurring worker failures and visible availability degradation.

How to fix it

Upgrade PHP to a fixed release for the active branch in use: PHP 8.2.31 or later, PHP 8.3.31 or later, PHP 8.4.21 or later, or PHP 8.5.6 or later. Prioritize internet-facing PHP services, especially those deployed on NetBSD or other platforms with signed char defaults and optimized ctype table implementations. If immediate upgrade is not possible, reduce exposure by placing affected applications behind a reverse proxy or WAF, rate-limit suspicious malformed URL-encoded requests, ensure process managers restart crashed workers, and monitor for repeated PHP worker crashes. Mitigations should be treated as temporary because input filtering may not cover every vulnerable code path.

How to confirm the fix worked

Confirm the installed PHP runtime version with commands such as php -v and package-manager queries, and verify it is at or above the fixed version for its branch. For web deployments, confirm the version used by PHP-FPM, Apache mod_php, CLI jobs, containers, and any embedded PHP runtime, because multiple PHP versions may coexist. Validate operating system exposure by identifying NetBSD or other platforms with signed char behavior. After patching, restart PHP-FPM, web server workers, containers, and long-running PHP processes so the fixed runtime is actually loaded. Review crash logs before and after remediation to confirm that malformed request handling no longer produces PHP worker crashes.

Typical attack path

1. Identify an internet-facing service or application that uses an affected PHP 8.2, 8.3, 8.4, or 8.5 runtime.
2. Determine whether the service runs on a susceptible platform where char is signed by default and ctype table lookups are used, such as NetBSD-like environments.
3. Send crafted HTTP requests containing malformed URL-encoded byte sequences intended to reach PHP URL decoding or related parsing logic.
4. Trigger the signed char value to be passed into ctype logic such as isxdigit().
5. Cause an out-of-bounds ctype table access that may crash the PHP worker or runtime process.
6. Repeat requests to produce sustained application instability or denial of service.

How to detect it

To determine whether exploitation may have occurred, review web server, reverse proxy, PHP-FPM, application, kernel, and process supervisor logs for repeated malformed URL-encoded requests followed by PHP worker crashes, segmentation faults, abnormal exits, or spikes in HTTP 500/502/503 responses. Useful log sources include Nginx or Apache access/error logs, PHP-FPM logs, syslog, kern.log or messages, container runtime logs, systemd journal entries, crash dumps, and monitoring alerts for process restarts. Look for requests containing unusual or invalid percent-encoded byte sequences, especially high-bit bytes such as %80 through %FF, malformed percent encodings, or bursts from the same source IP immediately preceding PHP process termination. Because no public weaponized exploit maturity or named threat actor activity is reported, detection should focus on behavioral correlation: suspicious encoded input plus PHP worker crash or service degradation.

• PHP Fatal error
• child exited on signal 11
• SIGSEGV
• segmentation fault
• php-fpm
• exited on signal 11 (SIGSEGV)
• server reached max_children setting
• upstream prematurely closed connection
• recv() failed (104: Connection reset by peer) while reading response header from upstream
• HTTP/1.1" 500
• HTTP/1.1" 502
• HTTP/1.1" 503
• %80
• %81
• %82
• %83
• %84
• %85
• %86
• %87
• %88
• %89
• %8A
• %8B
• %8C
• %8D
• %8E
• %8F
• %90
• %91
• %92
• %93
• %94
• %95
• %96
• %97
• %98
• %99
• %9A
• %9B
• %9C
• %9D
• %9E
• %9F
• %A0
• %B0
• %C0
• %D0
• %E0
• %F0
• php-fpm.service: Main process exited
• php-fpm.service: Failed with result 'signal'

What your security team should do

• Inventory all PHP runtimes across servers, containers, base images, developer platforms, and appliance-like deployments.
• Patch affected branches to PHP 8.2.31+, 8.3.31+, 8.4.21+, or 8.5.6+ based on the deployed branch.
• Prioritize externally exposed PHP applications on NetBSD or similar platforms where the vulnerable ctype behavior is most likely to be reachable.
• Restart PHP-FPM, Apache, web servers, containers, and background workers after updating to ensure the patched binary is in use.
• Add monitoring for repeated PHP worker crashes, segmentation faults, abnormal 5xx spikes, and malformed percent-encoded request patterns.
• Apply rate limiting or WAF rules for repeated malformed URL-encoded requests as a temporary control where patching must be delayed.
• Track PHP runtime versions in software composition and container image scanning to prevent reintroduction through old base images.