In PHP versions 8

CVE-2026-7262 is a NULL-pointer crash in PHP ext-soap when SoapServer decodes an apache:Map element that is missing a <value> node. The vulnerable ranges are PHP 8.2 before 8.2.31, 8.3 before 8.3.31, 8.4 before 8.4.21, and 8.5 before 8.5.6; downstream distros may instead ship backported package builds such as Debian php8.2 8.2.31-1~deb12u1, php8.4 8.4.21-1~deb13u1, and Bullseye LTS php7.4 7.4.33-1+deb11u11.

The headline 7.5/High label is too hot for real enterprise triage. The attack is network-reachable only if you expose a PHP SOAP server endpoint, and the buggy branch is reachable only when the application has a typemap configured; even then the practical impact is availability loss via segfault, which in common php-fpm deployments usually kills a worker and gets respawned rather than handing the attacker code execution or durable access.

Why this verdict

• Start from 7.5, then subtract for reachability reality: CVSS assumes any network path is equally reachable; in practice this only matters where a PHP SOAP server endpoint is actually exposed.
• Subtract again for app-level prerequisite: exploitation requires SoapServer *and* a configured typemap, which is a meaningful narrowing of the affected population.
• Keep it at MEDIUM, not LOW, because it is still unauthenticated remote: once the right endpoint exists, the request is simple and the advisory practically hands you the trigger.
• No exploitation amplifier present: no KEV listing, no observed campaign reporting, and a very low EPSS all argue against emergency handling.
• Blast radius is usually bounded: common php-fpm or supervised web stacks respawn workers, so many deployments see transient degradation rather than sustained single-packet outage.

Why not higher?

This is not a broad internet-kill switch for 'all PHP.' The exploit path depends on a reachable SOAP server endpoint and the relatively uncommon typemap configuration, and the documented outcome is availability loss only. Without evidence of large-scale exposure or active exploitation, there is no reason to keep this in HIGH.

Why not lower?

I am not dropping it to LOW because the attacker does not need credentials or user interaction. If you do run a reachable SOAP service with typemap, the crash path is straightforward and repeatable, so externally exposed integration nodes still deserve attention.

1. Restrict SOAP endpoints — Put externally reachable SOAP services behind partner IP allowlists, VPN, or API gateway policy where possible. For a MEDIUM verdict there is no mitigation SLA — use this as an interim hardening step if patching will wait inside the 365-day remediation window.
2. Rate-limit and circuit-break — Apply per-client request throttling and fast-fail thresholds on SOAP paths so repeated worker crashes cannot turn into sustained service exhaustion. For MEDIUM, there is no mitigation SLA — deploy on internet-facing SOAP services now if those services must remain on vulnerable builds for a while.
3. Add XML/SOAP request validation at the edge — If you have an API gateway, WAF, or custom proxy capable of SOAP-aware inspection, block malformed apache:Map payloads that omit <value> nodes. For MEDIUM, there is no mitigation SLA — prioritize only the externally exposed SOAP paths where business ownership confirms SoapServer usage.
4. Monitor php-fpm and web worker crash loops — Alert on repeated worker exits, segfaults, and short-lived php-fpm children tied to SOAP routes so attempted exploitation becomes visible before it becomes an outage. For MEDIUM, there is no mitigation SLA — wire this into normal operational monitoring while you patch within the remediation window.

Run this on the target Linux host or container image that serves the PHP application, not from an auditor workstation. Invoke it as sudo bash verify-cve-2026-7262.sh /var/www or point it at your app root; root is not strictly required, but you need read access to PHP binaries, package metadata, and application source paths to avoid UNKNOWN results.

#!/usr/bin/env bash
# verify-cve-2026-7262.sh
# Checks for likely exposure to CVE-2026-7262 on Linux PHP hosts.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

SEARCH_ROOT="${1:-/var/www}"

found_php=0
found_vuln_version=0
found_soap=0
found_soapserver_code=0
found_typemap_code=0
unknown=0
summary=()

ver_lt() {
  [ "$1" = "$2" ] && return 1
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

is_vulnerable_upstream() {
  local v="$1"
  case "$v" in
    8.2.*) ver_lt "$v" "8.2.31" ; return $? ;;
    8.3.*) ver_lt "$v" "8.3.31" ; return $? ;;
    8.4.*) ver_lt "$v" "8.4.21" ; return $? ;;
    8.5.*) ver_lt "$v" "8.5.6" ; return $? ;;
    *) return 1 ;;
  esac
}

check_php_bin() {
  local bin="$1"
  command -v "$bin" >/dev/null 2>&1 || return 0
  found_php=1

  local version
  version="$($bin -r 'echo PHP_VERSION;' 2>/dev/null || true)"
  if [ -z "$version" ]; then
    unknown=1
    summary+=("$bin:version-unknown")
    return 0
  fi

  local has_soap
  has_soap="$($bin -r 'echo extension_loaded("soap") ? "yes" : "no";' 2>/dev/null || true)"
  if [ "$has_soap" = "yes" ]; then
    found_soap=1
    summary+=("$bin:$version:soap")
  else
    summary+=("$bin:$version:no-soap")
  fi

  if is_vulnerable_upstream "$version"; then
    found_vuln_version=1
    summary+=("$bin:$version:upstream-vulnerable-range")
  fi
}

# Common PHP binary names
for b in php php8.2 php8.3 php8.4 php8.5; do
  check_php_bin "$b"
done

# Package manager hints for backports
if command -v dpkg-query >/dev/null 2>&1; then
  pkg_info=$(dpkg-query -W -f='${Package} ${Version}\n' 'php*' 2>/dev/null | grep -E '^(php|php[0-9]\.[0-9]|php[0-9]\.[0-9]-soap|php-soap) ' || true)
  [ -n "$pkg_info" ] && summary+=("dpkg-packages-detected")
fi

if command -v rpm >/dev/null 2>&1; then
  pkg_info_rpm=$(rpm -qa 2>/dev/null | grep -E '^php([0-9]{2}|[0-9]\.[0-9])?(-soap)?-' || true)
  [ -n "$pkg_info_rpm" ] && summary+=("rpm-packages-detected")
fi

# Source search for SoapServer + typemap usage
if [ -d "$SEARCH_ROOT" ]; then
  if grep -RIl --include='*.php' 'new[[:space:]]\+SoapServer' "$SEARCH_ROOT" >/dev/null 2>&1; then
    found_soapserver_code=1
    summary+=("soapserver-code-found")
  fi
  if grep -RIl --include='*.php' "['\"]typemap['\"]\s*=>\|typemap\s*=>" "$SEARCH_ROOT" >/dev/null 2>&1; then
    found_typemap_code=1
    summary+=("typemap-code-found")
  fi
else
  unknown=1
  summary+=("search-root-missing:$SEARCH_ROOT")
fi

# Decision logic
if [ "$found_php" -eq 0 ]; then
  echo "UNKNOWN - no PHP binary found in PATH; $(IFS=,; echo "${summary[*]}")"
  exit 2
fi

if [ "$found_vuln_version" -eq 0 ]; then
  echo "PATCHED - no upstream-vulnerable PHP branch/version found; $(IFS=,; echo "${summary[*]}")"
  exit 0
fi

if [ "$found_soap" -eq 0 ]; then
  echo "PATCHED - vulnerable-version PHP found, but soap extension not loaded in checked binaries; $(IFS=,; echo "${summary[*]}")"
  exit 0
fi

if [ "$found_soapserver_code" -eq 1 ] && [ "$found_typemap_code" -eq 1 ]; then
  echo "VULNERABLE - vulnerable PHP version + soap loaded + SoapServer code + typemap usage found; $(IFS=,; echo "${summary[*]}")"
  exit 1
fi

if [ "$found_soapserver_code" -eq 1 ] || [ "$found_typemap_code" -eq 1 ] || [ "$unknown" -eq 1 ]; then
  echo "UNKNOWN - vulnerable PHP version + soap loaded, but app-level exploitability could not be fully confirmed; $(IFS=,; echo "${summary[*]}")"
  exit 2
fi

echo "UNKNOWN - vulnerable PHP version + soap loaded, but no SoapServer/typemap evidence found under $SEARCH_ROOT; $(IFS=,; echo "${summary[*]}")"
exit 2

Sources

1. PHP Group GitHub advisory GHSA-hmxp-6pc4-f3vv
2. NVD CVE-2026-7262
3. PHP 8 changelog
4. Fix commit 79551ab
5. Ubuntu CVE tracker
6. Debian security tracker
7. CISA Known Exploited Vulnerabilities Catalog
8. Snyk vulnerability record with EPSS