CVE-2026-7260

highcovered by 4 sourcesfirst seen 2026-07-30

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language, which could result in denial of service, SQL injection, information disclosure or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6406-1

⚡ Watch CVE-2026-7260

Get an email if CVE-2026-7260 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.

Advisory coverage (4)

high[NEU] [hoch] PHP: Mehrere Schwachstellencert-bund · 2026-07-31
unknownDSA-6406-1 php8.4 - security updatedebian · 2026-07-31
unknownMultiples vulnérabilités dans PHP (31 juillet 2026)cert-fr-avis · 2026-07-31
unknownCVE-2026-7260: Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C st…nvd · 2026-07-30

External references

NVD record for CVE-2026-7260

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-7260 status](https://www.csirts.com/badge/CVE-2026-7260)](https://www.csirts.com/cve/CVE-2026-7260)