CVE-2026-7260

The CVE affects PHP’s phar handling, where circular symbolic links in phar archives can cause unbounded recursion, exhausting the C stack and crashing the PHP process. Affected versions are PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9. Root cause is un...