A security flaw has been discovered in specific recent versions of PHP, the software that powers most dynamic, interactive websites. The bug exists in a function called bccomp(), which is used to compare high-precision numeric values for tasks like financial calculations or scientific data processing. If an attacker can send specially crafted inputs to this function, it can cause the software to write data outside of its allowed memory areas. This corrupts both temporary working memory and long-term stored data, and may allow an attacker to run unauthorized code on your server, potentially taking full control of your website or stealing sensitive visitor or business data. The vulnerability only impacts PHP 8.4.* versions older than 8.4.24, and PHP 8.5.* versions older than 8.5.9. Sites running these affected PHP versions are at risk if an attacker is able to send malicious inputs to the vulnerable function.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-17544
