CVE-2026-17543
EPSS 0.4%Active vendor patching but no KEV, no PoC, no exploitation reports; early-stage disclosure.
What: Improper backslash escaping in PHP 8.2–8.5 allows SQL injection in PostgreSQL queries via ext-pgsql. No CVSS/EPSS assigned yet.
Why it matters: PHP maintainers patched actively (8.2.33, 8.3.33, 8.4.24, 8.5.9 released); backports rolled to 7.4 and 8.0–8.1 within hours. Vuln is trivial to trigger but KEV not yet listed. No public PoC or in-the-wild reports in chatter; signal is vendor advisory + coordinated patching across versions.
Where it's seen: Security news aggregators amplifying patch notices; package maintainers (Remi repos) backporting fixes across unsupported PHP versions same day. No defender questions or exploitation claims yet.
RISK: HIGH — Trivial SQL injection in widely-deployed language; urgent patching across multiple versions signals severity.
Description
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.