Critical PHP SOAP Extension Vulnerabilities Enables Remote Code Execution Attacks

A cluster of serious PHP vulnerabilities—most notably CVE-2026-6722, an unauthenticated use-after-free in the SOAP extension enabling remote code execution—has been disclosed. Additional flaws include session-related UAF, NULL-dereference DoS, an urldecode out-of-bounds read, and an mbstring buffer overrun affecting multiple supported PHP branches; maintainers have released patches in PHP 8.2.31, 8.3.31, 8.4.21, and 8.5.6 and administrators are urged to update immediately.