CVE-2026-7262

What it actually does

This vulnerability affects PHP SOAP servers that use a configured SOAP typemap. During SOAP request decoding, PHP checks the wrong variable when an expected value element is missing, causing a NULL pointer dereference and segmentation fault. A remote unauthenticated attacker can send a specially crafted SOAP request to a reachable SOAP endpoint and crash the PHP process handling the request. The impact is denial of service rather than code execution or data disclosure, but availability can be materially affected if the process manager repeatedly respawns crashing workers or if traffic is sustained.

Why it matters to the business

Public or internal applications that expose PHP SOAP services may become unavailable if an attacker repeatedly sends malformed SOAP requests. This can disrupt customer-facing services, partner integrations, billing workflows, identity or provisioning systems, and other legacy SOAP-dependent business processes. The CVSS score is high for availability impact, but current EPSS is low and there is no known KEV listing or reported ransomware use, so remediation should be prioritized based on exposure of SOAP endpoints and business criticality rather than assumed active exploitation.

How an attack unfolds

An attacker first identifies an application endpoint backed by PHP's SOAP server implementation, typically by finding WSDL URLs, SOAPAction responses, XML/SOAP error messages, or application routes that accept SOAP XML over HTTP. If the service uses a SOAP typemap, the attacker sends a malformed SOAP envelope in which the decoded object omits the expected value element that triggers the vulnerable code path. Because the decoder checks the wrong variable, PHP dereferences a NULL pointer and the worker process crashes with a segmentation fault. The attacker does not need authentication, user interaction, or network adjacency if the SOAP endpoint is reachable. Repeating the request can keep PHP-FPM, Apache mod_php workers, or CLI-based SOAP server processes crashing, degrading capacity or causing full service outage depending on process supervision and load balancing.

How to fix it

Upgrade PHP to a fixed release for the deployed branch: PHP 8.2.31 or later, PHP 8.3.31 or later, PHP 8.4.21 or later, or PHP 8.5.6 or later. After upgrading, restart PHP-FPM, Apache, web servers, job runners, containers, and any long-running services that embed PHP so the patched runtime is actually in use. If immediate upgrade is not possible, reduce exposure by disabling unused SOAP endpoints, removing or avoiding vulnerable typemap configurations where feasible, restricting access to SOAP services with network controls or authentication gateways, enforcing request size and schema validation before PHP SOAP decoding, and rate-limiting repeated malformed SOAP requests. Because this is a crash vulnerability, mitigations should be treated as temporary; patching PHP is the durable fix.

How to confirm the fix worked

Confirm the runtime version used by the application is one of the fixed versions or newer using package manager output, container image inventory, and runtime checks such as `php -v` from the same execution context as the web service. Verify that all PHP SAPIs in use were updated, including PHP-FPM pools, Apache mod_php modules, CLI workers, and container images. Exercise SOAP endpoints with normal regression tests to ensure service compatibility after the upgrade. Where safe and authorized, use a non-destructive vulnerability test or vendor-provided reproducer against a staging environment to confirm malformed typemap SOAP input no longer crashes the PHP process. Monitor error logs after deployment to ensure segmentation faults stop occurring and workers remain stable under malformed request testing.

Typical attack path

1. Discover reachable PHP SOAP endpoints, such as WSDL URLs or HTTP routes accepting SOAP XML.
2. Confirm that the endpoint is handled by PHP SOAP server functionality and accepts typemap-driven payloads.
3. Send a specially crafted SOAP request with a missing expected value element in the typemap-decoded structure.
4. Trigger a NULL pointer dereference during SOAP decoding, causing a segmentation fault in the PHP process.
5. Repeat requests to exhaust worker capacity, force process restarts, or cause sustained denial of service.

How to detect it

To determine whether exploitation may have occurred, review web server, reverse proxy, WAF, application, PHP-FPM, Apache, systemd, kernel, and container logs for correlated bursts of SOAP HTTP POST requests followed by PHP worker crashes or segmentation faults. Focus on SOAP endpoints, WSDL-adjacent URLs, XML payloads with unusual missing or empty elements, repeated unauthenticated requests, and increases in HTTP 500, 502, or 503 responses. On Linux systems, inspect kernel logs, journald, syslog, PHP-FPM logs, Apache error logs, and container runtime events for `segfault` or abnormal PHP worker termination. Where core dumps are enabled, check for PHP or web server core files generated near suspicious SOAP requests. If threat hunting across network telemetry, look for repeated `text/xml` or `application/soap+xml` POST requests to the same endpoint from one source or distributed sources, especially where responses are truncated, 5xx, or followed by backend worker restarts. No named threat actors or campaigns are currently associated with this issue in the provided intelligence.

• segfault at
• php-fpm
• child exited on signal 11
• exited on signal 11
• Segmentation fault
• core dumped
• SOAP-ENV:Envelope
• application/soap+xml
• text/xml
• SOAPAction:
• ?wsdl
• /wsdl
• HTTP/1.1" 500
• HTTP/1.1" 502
• HTTP/1.1" 503
• kernel: php-fpm
• kernel: php
• systemd-coredump
• php-cgi
• apache2: segfault
• httpd: segfault

What your security team should do

• Inventory internet-facing and partner-facing SOAP endpoints implemented in PHP, especially those exposing WSDL files or using custom SOAP typemaps.
• Prioritize patching systems running PHP 8.2 before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21, or 8.5 before 8.5.6 where SOAP services are reachable.
• Restart all PHP execution environments after patching and verify the active runtime version, not only the installed package version.
• Apply temporary access controls, WAF/API gateway rules, schema validation, and rate limits around SOAP endpoints until all affected PHP runtimes are upgraded.
• Add monitoring for PHP segmentation faults, repeated worker exits, spikes in HTTP 500/502/503 responses, and bursts of malformed SOAP requests.
• Review availability controls for critical SOAP services, including process supervision, load balancing, autoscaling, and alerting on worker crash loops.
• Because there is no KEV listing, no known ransomware use, and low EPSS at the time of assessment, treat this as exposure-driven high-priority remediation rather than an emergency across non-SOAP PHP workloads.