PHP fixes an SQL injection in the pg_* functions
CVE-2026-17543 (High) is an SQL injection in pg_insert, pg_update, pg_select and pg_delete. It was fixed in the July 30 releases.
What to do
Update PHP if you run anything older than the July 30 security releases. If you use PostgreSQL through these functions rather than PDO, treat it as urgent.
CVE-2026-17543 (High): the pg_* convenience functions wrap values in E'...' strings, but under PostgreSQL's default standard_conforming_strings = on, backslashes weren't escaped, so crafted input could break out of the string and inject SQL.
Fixed in 8.2.33, 8.3.33, 8.4.24 and 8.5.9 (July 30). The current releases are 8.5.10 and 8.4.25.