Update PHP if you run anything older than the July 30 security releases. If you use PostgreSQL through these functions rather than PDO, treat it as urgent.
Key facts
Severity
High
Fixed in
8.2.33, 8.3.33, 8.4.24, 8.5.9
Advisory IDs
CVE-2026-17543, GHSA-7qpv-r5mr-78m4
CVE-2026-17543 (High): the pg_* convenience functions wrap values in E'...' strings, but under PostgreSQL's default standard_conforming_strings = on, backslashes weren't escaped, so crafted input could break out of the string and inject SQL.
Fixed in 8.2.33, 8.3.33, 8.4.24 and 8.5.9 (July 30). The current releases are 8.5.10 and 8.4.25.
