PHP SoapServer session-persisted object use-after-free via SOAP header fault

#!/usr/bin/env bash
# check-cve-2026-7261.sh
# Detect likely exposure to CVE-2026-7261 on a host.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APP_PATH="${1:-}"
PHP_BIN="${PHP_BIN:-php}"

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && return 1
  [ "$1" = "$2" ] && return 1
  return 0
}

in_vuln_range() {
  local v="$1"
  if ver_lt "$v" "8.2.31" && ! ver_lt "$v" "8.2.0"; then return 0; fi
  if ver_lt "$v" "8.3.31" && ! ver_lt "$v" "8.3.0"; then return 0; fi
  if ver_lt "$v" "8.4.21" && ! ver_lt "$v" "8.4.0"; then return 0; fi
  if ver_lt "$v" "8.5.6"  && ! ver_lt "$v" "8.5.0"; then return 0; fi
  return 1
}

if ! command -v "$PHP_BIN" >/dev/null 2>&1; then
  echo "UNKNOWN: php binary not found in PATH"
  exit 2
fi

PHP_VERSION="$($PHP_BIN -r 'echo PHP_VERSION;' 2>/dev/null)"
if [ -z "$PHP_VERSION" ]; then
  echo "UNKNOWN: unable to determine PHP version"
  exit 2
fi

SOAP_LOADED="$($PHP_BIN -m 2>/dev/null | awk 'BEGIN{IGNORECASE=1} /^soap$/{print "yes"}')"
if [ "$SOAP_LOADED" != "yes" ]; then
  echo "UNKNOWN: ext-soap not loaded in this PHP SAPI; verify web SAPI separately"
  exit 2
fi

if ! in_vuln_range "$PHP_VERSION"; then
  echo "PATCHED: PHP $PHP_VERSION is outside the affected upstream ranges"
  exit 0
fi

if [ -z "$APP_PATH" ]; then
  echo "UNKNOWN: PHP $PHP_VERSION is in an affected range and ext-soap is loaded; rerun with app path to check for SOAP_PERSISTENCE_SESSION usage"
  exit 2
fi

if [ ! -d "$APP_PATH" ]; then
  echo "UNKNOWN: app path '$APP_PATH' does not exist or is not a directory"
  exit 2
fi

MATCHES=$(grep -RInE 'SOAP_PERSISTENCE_SESSION|setPersistence\s*\(\s*1\s*\)' "$APP_PATH" 2>/dev/null | head -n 20 || true)
if [ -n "$MATCHES" ]; then
  echo "VULNERABLE: PHP $PHP_VERSION is affected, ext-soap is loaded, and app code appears to use SOAP_PERSISTENCE_SESSION"
  echo "$MATCHES"
  exit 1
fi

echo "UNKNOWN: PHP $PHP_VERSION is affected and ext-soap is loaded, but no obvious SOAP_PERSISTENCE_SESSION usage was found under $APP_PATH"
exit 2