Critical PHP Vulnerability (CVE-2026-6722): What UAE Businesses Need to Do Now

PHP runs a large share of the web — including WordPress, Laravel, and countless custom business applications across the UAE. So when the PHP project ships a critical security release, it affects far more organisations than most realise. CVE-2026-6722, a flaw in PHP's SOAP extension that can lead to unauthenticated remote code execution, is exactly that kind of release. If your website or application runs PHP, here's what the vulnerability is, whether you're exposed, and how to patch without breaking production.

What CVE-2026-6722 actually is

The flaw is a use-after-free in the SOAP extension's object handling — a class of memory-corruption bug where code keeps using memory after it has been released, which an attacker can manipulate to run their own code. In this case it can be triggered by a crafted SOAP request, meaning an attacker who can send requests to a vulnerable SoapServer endpoint may be able to achieve remote code execution without authenticating first.

That combination — unauthenticated, remote, and code execution — is the most serious category of web vulnerability there is. The PHP Group rates it critical with a CVSS 4.0 score of 9.5, and the US National Vulnerability Database scores it 9.8 on CVSS 3.1. The upstream advisory is tracked as GHSA-85c2-q967-79q5.

Are you affected?

Two conditions determine real-world exposure:

1. You're running an unpatched PHP version. The fix was released on 7 May 2026 in PHP 8.2.31, 8.3.31, 8.4.21, and 8.5.6. Any release earlier than these in each branch contains the flaw. (Linux distributions backport fixes, so a patched Debian or Red Hat package will show a different version string — see below.)
2. The SOAP extension is loaded, and untrusted clients can reach it. The risk is highest where a SoapServer endpoint accepts request bodies from the internet. If the SOAP extension isn't loaded, or your SOAP endpoints are only reachable internally, your exposure is lower — but "lower" is not "none," and relying on that assumption without checking is how incidents happen.

The practical problem is that most teams don't actually know which PHP version they're on, which extensions are loaded, or whether anything exposes SOAP — which is precisely why a flaw like this lingers on production servers long after a patch exists.

What to do, in order

1. Find out what you're running. Check your PHP version (php -v on the server, or your hosting control panel) and whether SOAP is enabled (php -m | grep -i soap). Do this for every environment — production, staging, and any older sites you've stopped thinking about but never decommissioned.

2. Update to a patched release. Move to PHP 8.2.31 / 8.3.31 / 8.4.21 / 8.5.6 or later for your branch — ideally the latest patch release available, since it rolls up this and every subsequent fix. If you're on a branch older than 8.2, you are also out of security support entirely and should plan an upgrade regardless of this specific CVE.

3. If you use a managed Linux distribution, trust the distro version, not the upstream number. Debian, Ubuntu, Red Hat and others backport security fixes into their own package versions — so a "fixed" package may read as something like 8.2.33-1~deb12u1 rather than 8.2.31. Apply your distribution's security updates and check its advisory rather than comparing against php.net's numbers.

4. Reduce exposure while you patch. If you don't actually use SOAP, disabling the extension removes the attack surface. Where SOAP is required, restrict which clients can reach those endpoints, and put a web application firewall in front of anything internet-facing as defence in depth — though a WAF is a stopgap, not a substitute for patching.

5. Test before you ship. A PHP point release is low-risk to apply, but "low-risk" isn't "no-risk" on a live revenue system. Update staging first, confirm the application still behaves, then roll to production — ideally with a backup and a rollback path ready, exactly as you would for any change to a production server.

Why these flaws keep catching businesses out

CVE-2026-6722 is serious, but the deeper problem it illustrates is routine: unpatched software is one of the most common root causes of breaches, not exotic zero-days. A critical PHP fix shipped in May; the question for any given business in October is simply whether anyone applied it. Servers drift out of date because patching is nobody's explicit job, legacy sites get forgotten, and "if it isn't broken, don't touch it" quietly becomes "if it isn't patched, don't notice it."

This is the gap a managed website and server AMC is designed to close — continuous monitoring of what versions are running, timely patching of the operating system, PHP runtime and application dependencies, and tested backups so an update can be applied and rolled back safely. For a broader view of the configuration mistakes that compound issues like this, see our cloud security misconfigurations checklist; and once you've patched, a penetration test against the OWASP-aligned checklist validates that nothing exploitable remains exposed.

If you're unsure whether your sites and servers are affected, TestUnity's cybersecurity team can assess your PHP estate, apply the fix safely, and keep it patched going forward.

FAQ

Does CVE-2026-6722 affect my WordPress or Laravel site?

It affects the underlying PHP runtime those applications run on, not WordPress or Laravel code specifically. If your server runs a PHP version older than 8.2.31 / 8.3.31 / 8.4.21 / 8.5.6 with the SOAP extension loaded and reachable, it's exposed regardless of the framework on top. Update PHP to a patched release.

How do I know if I'm running a vulnerable version?

Check your PHP version with php -v (or via your hosting panel) and whether SOAP is loaded with php -m. If the version predates the May 2026 patched releases for your branch and SOAP is enabled, treat it as vulnerable and update. On managed distributions, apply OS security updates and check the distro advisory rather than the upstream version number.

We don't use SOAP — are we still at risk?

Your exposure is lower, but confirm it rather than assume it. If the SOAP extension isn't loaded, this specific vector doesn't apply — and disabling an unused extension is good hardening anyway. You should still update PHP to a supported, patched release as part of routine maintenance.

Is updating PHP risky for a live site?

A point release (e.g. 8.3.x to a newer 8.3.x) is low-risk and rarely breaks application code, but any change to a production system should be tested on staging first, with a backup and rollback path ready. This is standard practice for patching under an ongoing maintenance programme, which is why managed patching exists rather than leaving it to ad-hoc effort.