PHP 8.2.33 - PostgreSQL And Input Security Fixes

PHP 8.2.33 was published on July 30, 2026 as a security release, with the PGSQL fix for CVE-2026-17543 as the most important change for data services. The patch closes an SQL injection path involving PostgreSQL escape string syntax. It also addresses security issues in Phar and GD plus a narrow DatePeriod memory leak.

The full release notes and downloads are on the GitHub release page. The four entries for this version are also recorded in the official PHP 8 change log.

PHP 8.2.33 fixes CVE-2026-17543 in the PGSQL extension. The documented failure is SQL injection through a backslash breakout in PostgreSQL E'...' escape strings. That puts database facing PHP workers first in the rollout queue, especially when query text includes values derived from feeds, scraped pages, CMS content, or external APIs.

The release note does not identify individual PGSQL functions or claim that every application level injection flaw is covered. Keep parameterized queries as the application boundary. Treat the runtime patch as defense for the extension path named in the change log, not as a replacement for query binding.

Regression checks should include the existing PostgreSQL integration suite and representative string values containing quotes and backslashes. Test the client functions that the service actually calls. This is more useful than a generic process health check because the defect sits at the query escaping boundary.

The Phar fix addresses CVE-2026-7260, a process crash triggered by recursive symlinks. For ETL or web processing jobs that inspect archives from outside the trust boundary, the stated risk is availability. The notes say crash, so there is no basis here for claiming code execution or data exposure.

PHP 8.2.33 also upgrades libgd for CVE-2026-9672. The change log does not describe the vulnerability class or affected image formats. Operators running thumbnail generation, media normalization, or image metadata stages should therefore verify that the deployed PHP artifact contains the updated GD build, then exercise the formats accepted by that workload.

Both fixes affect parsing paths that often receive less trusted data than the main application code. Rebuilding the runtime image or replacing the distribution package is necessary. A source change in php-src does not update an already deployed container by itself.

The only listed nonsecurity correction fixes a leak when DatePeriod::__construct() is called twice on the same object. This is a narrow lifecycle fix, not a general garbage collector or scheduler change.

Long running workers that repeatedly build date windows are the relevant case to inspect. Batch partitioning, retention calculations, and scheduled extraction ranges can all use DatePeriod, but the fix matters only if code reaches the documented double construction path. Existing memory telemetry should show whether that path had an operational effect.

This is a stable release, not a prerelease. The project documents no breaking change, configuration migration, or schema step for PHP 8.2.33. It does explicitly encourage all PHP 8.2 users to upgrade because this is a security release.

Roll the patched runtime through a canary before replacing the full worker or web fleet. Confirm the installed version with php -v, run PostgreSQL, archive, and image processing smoke tests, and watch process exits and worker memory during the rollout. The GD library change deserves an artifact check in addition to the PHP version check.