|
32441
|
1248
|
9
|
2026-05-13T09:22:35.813833+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664155813_m1.jpg...
|
Finder
|
screenpipe
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
2026-05-12
Today at 12:16
458,3 MB
Folder
audio
Today at 12:20
149,1 MB
Folder
MacBook Pro Microphone (input)_2026-05-12_18-45-26.mp4
Yesterday at 21:45
212 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-44-26.mp4
Yesterday at 21:44
215 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-43-26.mp4
Yesterday at 21:43
211 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-42-26.mp4
Yesterday at 21:42
214 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-41-26.mp4
Yesterday at 21:41
207 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-40-56.mp4
Yesterday at 21:41
206 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-40-26.mp4
Yesterday at 21:40
202 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-39-56.mp4
Yesterday at 21:40
199 KB
MPEG-4 movie
2026-05-11
Yesterday at 9:22
332,4 MB
Folder
2026-05-07
8 May 2026 at 9:26
305,6 MB
Folder
2026-05-06
6 May 2026 at 21:02
18,8 MB
Folder
2026-04-28
28 Apr 2026 at 22:23
166,7 MB
Folder
2026-04-27
28 Apr 2026 at 9:19
339,8 MB
Folder
2026-04-25
26 Apr 2026 at 16:35
39,7 MB
Folder
2026-04-24
24 Apr 2026 at 22:30
149,1 MB
Folder
2026-04-22
24 Apr 2026 at 12:08
265,5 MB
Folder
2026-04-23
24 Apr 2026 at 12:07
171,8 MB
Folder
2026-04-20
22 Apr 2026 at 18:44
525,4 MB
Folder
2026-04-21
22 Apr 2026 at 9:16
450,8 MB
Folder
2026-04-17
18 Apr 2026 at 13:35
699,6 MB
Folder
2026-04-16
17 Apr 2026 at 8:57
837,2 MB
Folder
2026-04-15
16 Apr 2026 at 9:13
2,15 GB
Folder
2026-04-14
15 Apr 2026 at 9:59
1,09 GB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"Favourites","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"jiminny","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"AirDrop","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Recents","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Applications","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Documents","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Downloads","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"iCloud","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"iCloud Drive","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Sync folder","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Locations","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"DXP4800PLUS-B5F","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Eject","depth":6,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"Network","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Tags","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"CRM","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Orange","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Red","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yellow","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Green","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Blue","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Purple","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"All Tags…","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Name","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Date Modified","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Size","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Kind","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"logs","depth":7,"on_screen":true,"value":"logs","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1,4 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-12.0.log","depth":7,"on_screen":true,"value":"screenpipe.2026-05-12.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:46","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"294 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-11.0.log","depth":7,"on_screen":true,"value":"screenpipe.2026-05-11.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"11 May 2026 at 22:54","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"529 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"sync.log","depth":7,"on_screen":true,"value":"sync.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 13:47","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-07.0.log","depth":7,"on_screen":true,"value":"screenpipe.2026-05-07.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"7 May 2026 at 21:50","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"566 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"data","depth":7,"on_screen":true,"value":"data","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7,99 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-12","depth":7,"on_screen":true,"value":"2026-05-12","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"458,3 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"audio","depth":7,"on_screen":true,"value":"audio","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"149,1 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-45-26.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-45-26.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:45","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"212 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-44-26.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-44-26.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:44","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"215 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-43-26.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-43-26.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:43","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"211 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-42-26.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-42-26.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:42","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"214 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-41-26.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-41-26.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:41","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"207 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-40-56.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-40-56.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:41","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"206 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-40-26.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-40-26.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:40","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"202 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"MacBook Pro Microphone (input)_2026-05-12_18-39-56.mp4","depth":7,"on_screen":true,"value":"MacBook Pro Microphone (input)_2026-05-12_18-39-56.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:40","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"199 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-11","depth":7,"on_screen":true,"value":"2026-05-11","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 9:22","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"332,4 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-07","depth":7,"on_screen":true,"value":"2026-05-07","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"8 May 2026 at 9:26","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"305,6 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-06","depth":7,"on_screen":true,"value":"2026-05-06","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"6 May 2026 at 21:02","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"18,8 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-28","depth":7,"on_screen":true,"value":"2026-04-28","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"28 Apr 2026 at 22:23","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"166,7 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-27","depth":7,"on_screen":true,"value":"2026-04-27","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"28 Apr 2026 at 9:19","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"339,8 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-25","depth":7,"on_screen":true,"value":"2026-04-25","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"26 Apr 2026 at 16:35","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"39,7 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-24","depth":7,"on_screen":true,"value":"2026-04-24","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"24 Apr 2026 at 22:30","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"149,1 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-22","depth":7,"on_screen":true,"value":"2026-04-22","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"24 Apr 2026 at 12:08","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"265,5 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-23","depth":7,"on_screen":true,"value":"2026-04-23","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"24 Apr 2026 at 12:07","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"171,8 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-20","depth":7,"on_screen":true,"value":"2026-04-20","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"22 Apr 2026 at 18:44","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"525,4 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-21","depth":7,"on_screen":true,"value":"2026-04-21","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"22 Apr 2026 at 9:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"450,8 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-17","depth":7,"on_screen":true,"value":"2026-04-17","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"18 Apr 2026 at 13:35","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"699,6 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-16","depth":7,"on_screen":true,"value":"2026-04-16","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"17 Apr 2026 at 8:57","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"837,2 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-15","depth":7,"on_screen":true,"value":"2026-04-15","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"16 Apr 2026 at 9:13","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2,15 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-14","depth":7,"on_screen":true,"value":"2026-04-14","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"15 Apr 2026 at 9:59","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1,09 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db","depth":7,"on_screen":true,"value":"archive.db","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"800 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"#recycle","depth":7,"on_screen":true,"value":"#recycle","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"70,01 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync.sh","depth":7,"on_screen":true,"value":"screenpipe_sync.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Today at 11:20","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"9 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"lib","depth":7,"on_screen":true,"value":"lib","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:24","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync_old.sh","depth":7,"on_screen":true,"value":"screenpipe_sync_old.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:22","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"18 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"on_screen":true,"role_description":"text"}]...
|
4950679936746480776
|
-31357676812533918
|
click
|
accessibility
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
2026-05-12
Today at 12:16
458,3 MB
Folder
audio
Today at 12:20
149,1 MB
Folder
MacBook Pro Microphone (input)_2026-05-12_18-45-26.mp4
Yesterday at 21:45
212 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-44-26.mp4
Yesterday at 21:44
215 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-43-26.mp4
Yesterday at 21:43
211 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-42-26.mp4
Yesterday at 21:42
214 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-41-26.mp4
Yesterday at 21:41
207 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-40-56.mp4
Yesterday at 21:41
206 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-40-26.mp4
Yesterday at 21:40
202 KB
MPEG-4 movie
MacBook Pro Microphone (input)_2026-05-12_18-39-56.mp4
Yesterday at 21:40
199 KB
MPEG-4 movie
2026-05-11
Yesterday at 9:22
332,4 MB
Folder
2026-05-07
8 May 2026 at 9:26
305,6 MB
Folder
2026-05-06
6 May 2026 at 21:02
18,8 MB
Folder
2026-04-28
28 Apr 2026 at 22:23
166,7 MB
Folder
2026-04-27
28 Apr 2026 at 9:19
339,8 MB
Folder
2026-04-25
26 Apr 2026 at 16:35
39,7 MB
Folder
2026-04-24
24 Apr 2026 at 22:30
149,1 MB
Folder
2026-04-22
24 Apr 2026 at 12:08
265,5 MB
Folder
2026-04-23
24 Apr 2026 at 12:07
171,8 MB
Folder
2026-04-20
22 Apr 2026 at 18:44
525,4 MB
Folder
2026-04-21
22 Apr 2026 at 9:16
450,8 MB
Folder
2026-04-17
18 Apr 2026 at 13:35
699,6 MB
Folder
2026-04-16
17 Apr 2026 at 8:57
837,2 MB
Folder
2026-04-15
16 Apr 2026 at 9:13
2,15 GB
Folder
2026-04-14
15 Apr 2026 at 9:59
1,09 GB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts...
|
32439
|
NULL
|
NULL
|
NULL
|
|
32442
|
1249
|
11
|
2026-05-13T09:22:36.262863+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664156262_m2.jpg...
|
Finder
|
screenpipe
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
2026-05-12
Today at 12:16
458,3 MB
Folder
2026-05-11
Yesterday at 9:22
332,4 MB
Folder
2026-05-07
8 May 2026 at 9:26
305,6 MB
Folder
2026-05-06
6 May 2026 at 21:02
18,8 MB
Folder
2026-04-28
28 Apr 2026 at 22:23
166,7 MB
Folder
2026-04-27
28 Apr 2026 at 9:19
339,8 MB
Folder
2026-04-25
26 Apr 2026 at 16:35
39,7 MB
Folder
2026-04-24
24 Apr 2026 at 22:30
149,1 MB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts
db.sqlite-shm
Today at 9:35
33 KB
Document
screenpipe_sync copy.sh
Yesterday at 21:20
15 KB
Terminal scripts
screenpipe_fts_migrate.sh
Yesterday at 20:25
9 KB
Terminal scripts
db.sqlite
Yesterday at 17:41
4,46 GB
Document
archive.db.bak-pre-installid
Yesterday at 15:20
12,92 GB
Document
screenpipe_sync_updated.sh
10 May 2026 at 13:06
20 KB
Terminal scripts
archive.db-bak
10 May 2026 at 12:31
11,13 GB
Document
app
26 Apr 2026 at 20:10
193 KB
Folder
db.sqlite-wal
26 Apr 2026 at 17:17
Zero bytes
Document
app_settings.json
18 Apr 2026 at 17:42
31 bytes
JSON
screenpipe.db
13 Apr 2026 at 17:21
Zero bytes
Document
pipes
11 Apr 2026 at 16:51
13 KB
Folder
Name
Date Modified
Size
Kind
1 of 23 selected, 1,92 TB available
screenpipe...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"Favourites","depth":6,"bounds":{"left":0.5046542,"top":0.061452515,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"jiminny","depth":6,"bounds":{"left":0.51263297,"top":0.08140463,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"AirDrop","depth":6,"bounds":{"left":0.51263297,"top":0.103751,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Recents","depth":6,"bounds":{"left":0.51263297,"top":0.12609737,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Applications","depth":6,"bounds":{"left":0.51263297,"top":0.14844373,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Documents","depth":6,"bounds":{"left":0.51263297,"top":0.1707901,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Downloads","depth":6,"bounds":{"left":0.51263297,"top":0.19313647,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas","depth":6,"bounds":{"left":0.51263297,"top":0.21548285,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"iCloud","depth":6,"bounds":{"left":0.5046542,"top":0.2434158,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"iCloud Drive","depth":6,"bounds":{"left":0.51263297,"top":0.26336792,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Sync folder","depth":6,"bounds":{"left":0.51263297,"top":0.2857143,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Locations","depth":6,"bounds":{"left":0.5046542,"top":0.31364724,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"DXP4800PLUS-B5F","depth":6,"bounds":{"left":0.51263297,"top":0.33359936,"width":0.043218084,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Eject","depth":6,"bounds":{"left":0.55651593,"top":0.33519554,"width":0.0043218085,"height":0.009577015},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"Network","depth":6,"bounds":{"left":0.51263297,"top":0.35594574,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Tags","depth":6,"bounds":{"left":0.5046542,"top":0.38387868,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"CRM","depth":6,"bounds":{"left":0.51263297,"top":0.4038308,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Orange","depth":6,"bounds":{"left":0.51263297,"top":0.42617717,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Red","depth":6,"bounds":{"left":0.51263297,"top":0.44852355,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yellow","depth":6,"bounds":{"left":0.51263297,"top":0.4708699,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Green","depth":6,"bounds":{"left":0.51263297,"top":0.49321628,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Blue","depth":6,"bounds":{"left":0.51263297,"top":0.51556265,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Purple","depth":6,"bounds":{"left":0.51263297,"top":0.53790903,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"All Tags…","depth":6,"bounds":{"left":0.51263297,"top":0.5602554,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Name","depth":7,"bounds":{"left":0.5827792,"top":0.06624102,"width":0.011635638,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Date Modified","depth":7,"bounds":{"left":0.8656915,"top":0.06624102,"width":0.026928192,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Size","depth":7,"bounds":{"left":0.92586434,"top":0.06624102,"width":0.008976064,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Kind","depth":7,"bounds":{"left":0.9581117,"top":0.06624102,"width":0.00930851,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"logs","depth":7,"bounds":{"left":0.5827792,"top":0.08938547,"width":0.011303191,"height":0.012769354},"on_screen":true,"value":"logs","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"bounds":{"left":0.8656915,"top":0.08938547,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1,4 MB","depth":7,"bounds":{"left":0.93916225,"top":0.08938547,"width":0.015957447,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.08938547,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-12.0.log","depth":7,"bounds":{"left":0.58776593,"top":0.105347164,"width":0.061835106,"height":0.012769354},"on_screen":true,"value":"screenpipe.2026-05-12.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:46","depth":7,"bounds":{"left":0.8656915,"top":0.105347164,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"294 KB","depth":7,"bounds":{"left":0.93849736,"top":0.105347164,"width":0.016289894,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.105347164,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-11.0.log","depth":7,"bounds":{"left":0.58776593,"top":0.121308856,"width":0.061170213,"height":0.012769354},"on_screen":true,"value":"screenpipe.2026-05-11.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"11 May 2026 at 22:54","depth":7,"bounds":{"left":0.8656915,"top":0.121308856,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"529 KB","depth":7,"bounds":{"left":0.93849736,"top":0.121308856,"width":0.016289894,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.121308856,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"sync.log","depth":7,"bounds":{"left":0.58776593,"top":0.13727055,"width":0.019614361,"height":0.012769354},"on_screen":true,"value":"sync.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 13:47","depth":7,"bounds":{"left":0.8656915,"top":0.13727055,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7 KB","depth":7,"bounds":{"left":0.9438165,"top":0.13727055,"width":0.010970744,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.13727055,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-07.0.log","depth":7,"bounds":{"left":0.58776593,"top":0.15323225,"width":0.061835106,"height":0.012769354},"on_screen":true,"value":"screenpipe.2026-05-07.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"7 May 2026 at 21:50","depth":7,"bounds":{"left":0.8656915,"top":0.15323225,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"566 KB","depth":7,"bounds":{"left":0.93849736,"top":0.15323225,"width":0.016289894,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.15323225,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"data","depth":7,"bounds":{"left":0.5827792,"top":0.16919394,"width":0.011635638,"height":0.012769354},"on_screen":true,"value":"data","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"bounds":{"left":0.8656915,"top":0.16919394,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7,99 GB","depth":7,"bounds":{"left":0.9368351,"top":0.16919394,"width":0.017952127,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.16919394,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-12","depth":7,"bounds":{"left":0.58776593,"top":0.18515563,"width":0.027260639,"height":0.012769354},"on_screen":true,"value":"2026-05-12","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"bounds":{"left":0.8656915,"top":0.18515563,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"458,3 MB","depth":7,"bounds":{"left":0.93351066,"top":0.18515563,"width":0.021276595,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.18515563,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-11","depth":7,"bounds":{"left":0.58776593,"top":0.20111732,"width":0.026595745,"height":0.012769354},"on_screen":true,"value":"2026-05-11","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 9:22","depth":7,"bounds":{"left":0.8656915,"top":0.20111732,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"332,4 MB","depth":7,"bounds":{"left":0.93351066,"top":0.20111732,"width":0.021276595,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.20111732,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-07","depth":7,"bounds":{"left":0.58776593,"top":0.21707901,"width":0.027925532,"height":0.012769354},"on_screen":true,"value":"2026-05-07","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"8 May 2026 at 9:26","depth":7,"bounds":{"left":0.8656915,"top":0.21707901,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"305,6 MB","depth":7,"bounds":{"left":0.93351066,"top":0.21707901,"width":0.021276595,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.21707901,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-05-06","depth":7,"bounds":{"left":0.58776593,"top":0.2330407,"width":0.02825798,"height":0.012769354},"on_screen":true,"value":"2026-05-06","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"6 May 2026 at 21:02","depth":7,"bounds":{"left":0.8656915,"top":0.2330407,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"18,8 MB","depth":7,"bounds":{"left":0.93650264,"top":0.2330407,"width":0.01861702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.2330407,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-28","depth":7,"bounds":{"left":0.58776593,"top":0.2490024,"width":0.02825798,"height":0.012769354},"on_screen":true,"value":"2026-04-28","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"28 Apr 2026 at 22:23","depth":7,"bounds":{"left":0.8656915,"top":0.2490024,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"166,7 MB","depth":7,"bounds":{"left":0.93351066,"top":0.2490024,"width":0.021276595,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.2490024,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-27","depth":7,"bounds":{"left":0.58776593,"top":0.26496407,"width":0.027925532,"height":0.012769354},"on_screen":true,"value":"2026-04-27","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"28 Apr 2026 at 9:19","depth":7,"bounds":{"left":0.8656915,"top":0.26496407,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"339,8 MB","depth":7,"bounds":{"left":0.93351066,"top":0.26496407,"width":0.021276595,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.26496407,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-25","depth":7,"bounds":{"left":0.58776593,"top":0.28092578,"width":0.02825798,"height":0.012769354},"on_screen":true,"value":"2026-04-25","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"26 Apr 2026 at 16:35","depth":7,"bounds":{"left":0.8656915,"top":0.28092578,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"39,7 MB","depth":7,"bounds":{"left":0.93650264,"top":0.28092578,"width":0.01861702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.28092578,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"2026-04-24","depth":7,"bounds":{"left":0.58776593,"top":0.29688746,"width":0.02825798,"height":0.012769354},"on_screen":true,"value":"2026-04-24","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"24 Apr 2026 at 22:30","depth":7,"bounds":{"left":0.8656915,"top":0.29688746,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"149,1 MB","depth":7,"bounds":{"left":0.93351066,"top":0.29688746,"width":0.021276595,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.29688746,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db","depth":7,"bounds":{"left":0.5827792,"top":0.18515563,"width":0.023936171,"height":0.012769354},"on_screen":true,"value":"archive.db","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"bounds":{"left":0.8656915,"top":0.18515563,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"800 MB","depth":7,"bounds":{"left":0.9375,"top":0.18515563,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.18515563,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"#recycle","depth":7,"bounds":{"left":0.5827792,"top":0.20111732,"width":0.019946808,"height":0.012769354},"on_screen":true,"value":"#recycle","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"bounds":{"left":0.8656915,"top":0.20111732,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"70,01 GB","depth":7,"bounds":{"left":0.93417555,"top":0.20111732,"width":0.020611702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.20111732,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync.sh","depth":7,"bounds":{"left":0.5827792,"top":0.21707901,"width":0.04288564,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Today at 11:20","depth":7,"bounds":{"left":0.8656915,"top":0.21707901,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"9 KB","depth":7,"bounds":{"left":0.9438165,"top":0.21707901,"width":0.010970744,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.21707901,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"lib","depth":7,"bounds":{"left":0.5827792,"top":0.2330407,"width":0.0076462766,"height":0.012769354},"on_screen":true,"value":"lib","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:24","depth":7,"bounds":{"left":0.8656915,"top":0.2330407,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"bounds":{"left":0.9305186,"top":0.2330407,"width":0.024268618,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.2330407,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync_old.sh","depth":7,"bounds":{"left":0.5827792,"top":0.2490024,"width":0.051529255,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync_old.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:22","depth":7,"bounds":{"left":0.8656915,"top":0.2490024,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"18 KB","depth":7,"bounds":{"left":0.9411569,"top":0.2490024,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.2490024,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite-shm","depth":7,"bounds":{"left":0.5827792,"top":0.26496407,"width":0.030585106,"height":0.012769354},"on_screen":true,"value":"db.sqlite-shm","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 9:35","depth":7,"bounds":{"left":0.8656915,"top":0.26496407,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"33 KB","depth":7,"bounds":{"left":0.9411569,"top":0.26496407,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.26496407,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync copy.sh","depth":7,"bounds":{"left":0.5827792,"top":0.28092578,"width":0.053523935,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync copy.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:20","depth":7,"bounds":{"left":0.8656915,"top":0.28092578,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"15 KB","depth":7,"bounds":{"left":0.9411569,"top":0.28092578,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.28092578,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_fts_migrate.sh","depth":7,"bounds":{"left":0.5827792,"top":0.29688746,"width":0.05651596,"height":0.012769354},"on_screen":true,"value":"screenpipe_fts_migrate.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 20:25","depth":7,"bounds":{"left":0.8656915,"top":0.29688746,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"9 KB","depth":7,"bounds":{"left":0.9438165,"top":0.29688746,"width":0.010970744,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.29688746,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite","depth":7,"bounds":{"left":0.5827792,"top":0.31284916,"width":0.020279255,"height":0.012769354},"on_screen":true,"value":"db.sqlite","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 17:41","depth":7,"bounds":{"left":0.8656915,"top":0.31284916,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4,46 GB","depth":7,"bounds":{"left":0.9368351,"top":0.31284916,"width":0.017952127,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.31284916,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db.bak-pre-installid","depth":7,"bounds":{"left":0.5827792,"top":0.32881084,"width":0.05817819,"height":0.012769354},"on_screen":true,"value":"archive.db.bak-pre-installid","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 15:20","depth":7,"bounds":{"left":0.8656915,"top":0.32881084,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"12,92 GB","depth":7,"bounds":{"left":0.93417555,"top":0.32881084,"width":0.020611702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.32881084,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync_updated.sh","depth":7,"bounds":{"left":0.5827792,"top":0.34477255,"width":0.061835106,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync_updated.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 13:06","depth":7,"bounds":{"left":0.8656915,"top":0.34477255,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"20 KB","depth":7,"bounds":{"left":0.9411569,"top":0.34477255,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.34477255,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db-bak","depth":7,"bounds":{"left":0.5827792,"top":0.36073422,"width":0.03324468,"height":0.012769354},"on_screen":true,"value":"archive.db-bak","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 12:31","depth":7,"bounds":{"left":0.8656915,"top":0.36073422,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"11,13 GB","depth":7,"bounds":{"left":0.93417555,"top":0.36073422,"width":0.020611702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.36073422,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"app","depth":7,"bounds":{"left":0.5827792,"top":0.37669593,"width":0.010305851,"height":0.012769354},"on_screen":true,"value":"app","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"26 Apr 2026 at 20:10","depth":7,"bounds":{"left":0.8656915,"top":0.37669593,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"193 KB","depth":7,"bounds":{"left":0.93849736,"top":0.37669593,"width":0.016289894,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.37669593,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite-wal","depth":7,"bounds":{"left":0.5827792,"top":0.3926576,"width":0.028922873,"height":0.012769354},"on_screen":true,"value":"db.sqlite-wal","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"26 Apr 2026 at 17:17","depth":7,"bounds":{"left":0.8656915,"top":0.3926576,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"bounds":{"left":0.9305186,"top":0.3926576,"width":0.024268618,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.3926576,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"app_settings.json","depth":7,"bounds":{"left":0.5827792,"top":0.4086193,"width":0.03856383,"height":0.012769354},"on_screen":true,"value":"app_settings.json","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"18 Apr 2026 at 17:42","depth":7,"bounds":{"left":0.8656915,"top":0.4086193,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"31 bytes","depth":7,"bounds":{"left":0.93583775,"top":0.4086193,"width":0.019281914,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"JSON","depth":7,"bounds":{"left":0.9581117,"top":0.4086193,"width":0.012965426,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.db","depth":7,"bounds":{"left":0.5827792,"top":0.424581,"width":0.03158245,"height":0.012769354},"on_screen":true,"value":"screenpipe.db","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"13 Apr 2026 at 17:21","depth":7,"bounds":{"left":0.8656915,"top":0.424581,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"bounds":{"left":0.9305186,"top":0.424581,"width":0.024268618,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.424581,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"pipes","depth":7,"bounds":{"left":0.5827792,"top":0.4405427,"width":0.013630319,"height":0.012769354},"on_screen":true,"value":"pipes","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"11 Apr 2026 at 16:51","depth":7,"bounds":{"left":0.8656915,"top":0.4405427,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"13 KB","depth":7,"bounds":{"left":0.9411569,"top":0.4405427,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.4405427,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Name","depth":6,"bounds":{"left":0.5711436,"top":0.061452515,"width":0.29288563,"height":0.022346368},"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXButton","text":"Date Modified","depth":6,"bounds":{"left":0.8640292,"top":0.061452515,"width":0.06017287,"height":0.022346368},"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXButton","text":"Size","depth":6,"bounds":{"left":0.92420214,"top":0.061452515,"width":0.032247342,"height":0.022346368},"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXButton","text":"Kind","depth":6,"bounds":{"left":0.95644945,"top":0.061452515,"width":0.040226065,"height":0.022346368},"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"1 of 23 selected, 1,92 TB available","depth":2,"bounds":{"left":0.7496675,"top":0.98324025,"width":0.06482713,"height":0.011173184},"on_screen":true,"automation_id":"_NS:34","role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":1,"bounds":{"left":0.5990692,"top":0.019952115,"width":0.14361702,"height":0.0415004},"on_screen":true,"role_description":"text"}]...
|
-9035118509973405502
|
-2319169068942329310
|
click
|
accessibility
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
2026-05-12
Today at 12:16
458,3 MB
Folder
2026-05-11
Yesterday at 9:22
332,4 MB
Folder
2026-05-07
8 May 2026 at 9:26
305,6 MB
Folder
2026-05-06
6 May 2026 at 21:02
18,8 MB
Folder
2026-04-28
28 Apr 2026 at 22:23
166,7 MB
Folder
2026-04-27
28 Apr 2026 at 9:19
339,8 MB
Folder
2026-04-25
26 Apr 2026 at 16:35
39,7 MB
Folder
2026-04-24
24 Apr 2026 at 22:30
149,1 MB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts
db.sqlite-shm
Today at 9:35
33 KB
Document
screenpipe_sync copy.sh
Yesterday at 21:20
15 KB
Terminal scripts
screenpipe_fts_migrate.sh
Yesterday at 20:25
9 KB
Terminal scripts
db.sqlite
Yesterday at 17:41
4,46 GB
Document
archive.db.bak-pre-installid
Yesterday at 15:20
12,92 GB
Document
screenpipe_sync_updated.sh
10 May 2026 at 13:06
20 KB
Terminal scripts
archive.db-bak
10 May 2026 at 12:31
11,13 GB
Document
app
26 Apr 2026 at 20:10
193 KB
Folder
db.sqlite-wal
26 Apr 2026 at 17:17
Zero bytes
Document
app_settings.json
18 Apr 2026 at 17:42
31 bytes
JSON
screenpipe.db
13 Apr 2026 at 17:21
Zero bytes
Document
pipes
11 Apr 2026 at 16:51
13 KB
Folder
Name
Date Modified
Size
Kind
1 of 23 selected, 1,92 TB available
screenpipe...
|
32440
|
NULL
|
NULL
|
NULL
|
|
32443
|
1248
|
10
|
2026-05-13T09:22:37.162307+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664157162_m1.jpg...
|
Finder
|
screenpipe
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts
db.sqlite-shm
Today at 9:35
33 KB
Document
screenpipe_sync copy.sh
Yesterday at 21:20
15 KB
Terminal scripts
screenpipe_fts_migrate.sh
Yesterday at 20:25
9 KB
Terminal scripts
db.sqlite
Yesterday at 17:41
4,46 GB
Document
archive.db.bak-pre-installid
Yesterday at 15:20
12,92 GB
Document
screenpipe_sync_updated.sh
10 May 2026 at 13:06
20 KB
Terminal scripts
archive.db-bak
10 May 2026 at 12:31
11,13 GB
Document
app
26 Apr 2026 at 20:10
193 KB
Folder
db.sqlite-wal
26 Apr 2026 at 17:17
Zero bytes
Document
app_settings.json
18 Apr 2026 at 17:42
31 bytes
JSON
screenpipe.db
13 Apr 2026 at 17:21
Zero bytes
Document
pipes
11 Apr 2026 at 16:51
13 KB
Folder
Name
Date Modified
Size
Kind
1 of 23 selected, 1,92 TB available
screenpipe...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"Favourites","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"jiminny","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"AirDrop","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Recents","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Applications","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Documents","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Downloads","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"iCloud","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"iCloud Drive","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Sync folder","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Locations","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"DXP4800PLUS-B5F","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Eject","depth":6,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"Network","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Tags","depth":6,"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"CRM","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Orange","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Red","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yellow","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Green","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Blue","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Purple","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"All Tags…","depth":6,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Name","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Date Modified","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Size","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Kind","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"logs","depth":7,"on_screen":true,"value":"logs","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1,4 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-12.0.log","depth":7,"on_screen":true,"value":"screenpipe.2026-05-12.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:46","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"294 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-11.0.log","depth":7,"on_screen":true,"value":"screenpipe.2026-05-11.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"11 May 2026 at 22:54","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"529 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"sync.log","depth":7,"on_screen":true,"value":"sync.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 13:47","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-07.0.log","depth":7,"on_screen":true,"value":"screenpipe.2026-05-07.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"7 May 2026 at 21:50","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"566 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"data","depth":7,"on_screen":true,"value":"data","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7,99 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db","depth":7,"on_screen":true,"value":"archive.db","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"800 MB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"#recycle","depth":7,"on_screen":true,"value":"#recycle","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"70,01 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync.sh","depth":7,"on_screen":true,"value":"screenpipe_sync.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 11:20","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"9 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"lib","depth":7,"on_screen":true,"value":"lib","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:24","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync_old.sh","depth":7,"on_screen":true,"value":"screenpipe_sync_old.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:22","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"18 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite-shm","depth":7,"on_screen":true,"value":"db.sqlite-shm","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 9:35","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"33 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync copy.sh","depth":7,"on_screen":true,"value":"screenpipe_sync copy.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:20","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"15 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_fts_migrate.sh","depth":7,"on_screen":true,"value":"screenpipe_fts_migrate.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 20:25","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"9 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite","depth":7,"on_screen":true,"value":"db.sqlite","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 17:41","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4,46 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db.bak-pre-installid","depth":7,"on_screen":true,"value":"archive.db.bak-pre-installid","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 15:20","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"12,92 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync_updated.sh","depth":7,"on_screen":true,"value":"screenpipe_sync_updated.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 13:06","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"20 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db-bak","depth":7,"on_screen":true,"value":"archive.db-bak","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 12:31","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"11,13 GB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"app","depth":7,"on_screen":true,"value":"app","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"26 Apr 2026 at 20:10","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"193 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite-wal","depth":7,"on_screen":true,"value":"db.sqlite-wal","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"26 Apr 2026 at 17:17","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"app_settings.json","depth":7,"on_screen":true,"value":"app_settings.json","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"18 Apr 2026 at 17:42","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"31 bytes","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"JSON","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.db","depth":7,"on_screen":true,"value":"screenpipe.db","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"13 Apr 2026 at 17:21","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"pipes","depth":7,"on_screen":true,"value":"pipes","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"11 Apr 2026 at 16:51","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"13 KB","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Name","depth":6,"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXButton","text":"Date Modified","depth":6,"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXButton","text":"Size","depth":6,"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXButton","text":"Kind","depth":6,"on_screen":true,"role_description":"sort button","subrole":"AXSortButton","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"1 of 23 selected, 1,92 TB available","depth":2,"bounds":{"left":1.0,"top":0.0,"width":-0.0013889074,"height":0.015555556},"on_screen":true,"automation_id":"_NS:34","role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":1,"on_screen":true,"role_description":"text"}]...
|
6753510581507061616
|
-2895665006687518806
|
click
|
accessibility
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts
db.sqlite-shm
Today at 9:35
33 KB
Document
screenpipe_sync copy.sh
Yesterday at 21:20
15 KB
Terminal scripts
screenpipe_fts_migrate.sh
Yesterday at 20:25
9 KB
Terminal scripts
db.sqlite
Yesterday at 17:41
4,46 GB
Document
archive.db.bak-pre-installid
Yesterday at 15:20
12,92 GB
Document
screenpipe_sync_updated.sh
10 May 2026 at 13:06
20 KB
Terminal scripts
archive.db-bak
10 May 2026 at 12:31
11,13 GB
Document
app
26 Apr 2026 at 20:10
193 KB
Folder
db.sqlite-wal
26 Apr 2026 at 17:17
Zero bytes
Document
app_settings.json
18 Apr 2026 at 17:42
31 bytes
JSON
screenpipe.db
13 Apr 2026 at 17:21
Zero bytes
Document
pipes
11 Apr 2026 at 16:51
13 KB
Folder
Name
Date Modified
Size
Kind
1 of 23 selected, 1,92 TB available
screenpipe...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32444
|
1249
|
12
|
2026-05-13T09:22:37.170461+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664157170_m2.jpg...
|
Finder
|
screenpipe
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts
db.sqlite-shm
Today at 9:35
33 KB
Document
screenpipe_sync copy.sh
Yesterday at 21:20
15 KB
Terminal scripts
screenpipe_fts_migrate.sh
Yesterday at 20:25
9 KB
Terminal scripts
db.sqlite
Yesterday at 17:41
4,46 GB
Document
archive.db.bak-pre-installid
Yesterday at 15:20
12,92 GB
Document
screenpipe_sync_updated.sh
10 May 2026 at 13:06
20 KB
Terminal scripts
archive.db-bak
10 May 2026 at 12:31
11,13 GB
Document
app
26 Apr 2026 at 20:10...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"Favourites","depth":6,"bounds":{"left":0.5046542,"top":0.061452515,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"jiminny","depth":6,"bounds":{"left":0.51263297,"top":0.08140463,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"AirDrop","depth":6,"bounds":{"left":0.51263297,"top":0.103751,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Recents","depth":6,"bounds":{"left":0.51263297,"top":0.12609737,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Applications","depth":6,"bounds":{"left":0.51263297,"top":0.14844373,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Documents","depth":6,"bounds":{"left":0.51263297,"top":0.1707901,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Downloads","depth":6,"bounds":{"left":0.51263297,"top":0.19313647,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas","depth":6,"bounds":{"left":0.51263297,"top":0.21548285,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"iCloud","depth":6,"bounds":{"left":0.5046542,"top":0.2434158,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"iCloud Drive","depth":6,"bounds":{"left":0.51263297,"top":0.26336792,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Sync folder","depth":6,"bounds":{"left":0.51263297,"top":0.2857143,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Locations","depth":6,"bounds":{"left":0.5046542,"top":0.31364724,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"DXP4800PLUS-B5F","depth":6,"bounds":{"left":0.51263297,"top":0.33359936,"width":0.043218084,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Eject","depth":6,"bounds":{"left":0.55651593,"top":0.33519554,"width":0.0043218085,"height":0.009577015},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"Network","depth":6,"bounds":{"left":0.51263297,"top":0.35594574,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Tags","depth":6,"bounds":{"left":0.5046542,"top":0.38387868,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"CRM","depth":6,"bounds":{"left":0.51263297,"top":0.4038308,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Orange","depth":6,"bounds":{"left":0.51263297,"top":0.42617717,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Red","depth":6,"bounds":{"left":0.51263297,"top":0.44852355,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yellow","depth":6,"bounds":{"left":0.51263297,"top":0.4708699,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Green","depth":6,"bounds":{"left":0.51263297,"top":0.49321628,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Blue","depth":6,"bounds":{"left":0.51263297,"top":0.51556265,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Purple","depth":6,"bounds":{"left":0.51263297,"top":0.53790903,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"All Tags…","depth":6,"bounds":{"left":0.51263297,"top":0.5602554,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Name","depth":7,"bounds":{"left":0.5827792,"top":0.06624102,"width":0.011635638,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Date Modified","depth":7,"bounds":{"left":0.8656915,"top":0.06624102,"width":0.026928192,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Size","depth":7,"bounds":{"left":0.92586434,"top":0.06624102,"width":0.008976064,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Kind","depth":7,"bounds":{"left":0.9581117,"top":0.06624102,"width":0.00930851,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"logs","depth":7,"bounds":{"left":0.5827792,"top":0.08938547,"width":0.011303191,"height":0.012769354},"on_screen":true,"value":"logs","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"bounds":{"left":0.8656915,"top":0.08938547,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1,4 MB","depth":7,"bounds":{"left":0.93916225,"top":0.08938547,"width":0.015957447,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.08938547,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-12.0.log","depth":7,"bounds":{"left":0.58776593,"top":0.105347164,"width":0.061835106,"height":0.012769354},"on_screen":true,"value":"screenpipe.2026-05-12.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:46","depth":7,"bounds":{"left":0.8656915,"top":0.105347164,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"294 KB","depth":7,"bounds":{"left":0.93849736,"top":0.105347164,"width":0.016289894,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.105347164,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-11.0.log","depth":7,"bounds":{"left":0.58776593,"top":0.121308856,"width":0.061170213,"height":0.012769354},"on_screen":true,"value":"screenpipe.2026-05-11.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"11 May 2026 at 22:54","depth":7,"bounds":{"left":0.8656915,"top":0.121308856,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"529 KB","depth":7,"bounds":{"left":0.93849736,"top":0.121308856,"width":0.016289894,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.121308856,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"sync.log","depth":7,"bounds":{"left":0.58776593,"top":0.13727055,"width":0.019614361,"height":0.012769354},"on_screen":true,"value":"sync.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 13:47","depth":7,"bounds":{"left":0.8656915,"top":0.13727055,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7 KB","depth":7,"bounds":{"left":0.9438165,"top":0.13727055,"width":0.010970744,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.13727055,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe.2026-05-07.0.log","depth":7,"bounds":{"left":0.58776593,"top":0.15323225,"width":0.061835106,"height":0.012769354},"on_screen":true,"value":"screenpipe.2026-05-07.0.log","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"7 May 2026 at 21:50","depth":7,"bounds":{"left":0.8656915,"top":0.15323225,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"566 KB","depth":7,"bounds":{"left":0.93849736,"top":0.15323225,"width":0.016289894,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Log File","depth":7,"bounds":{"left":0.9581117,"top":0.15323225,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"data","depth":7,"bounds":{"left":0.5827792,"top":0.16919394,"width":0.011635638,"height":0.012769354},"on_screen":true,"value":"data","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"bounds":{"left":0.8656915,"top":0.16919394,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7,99 GB","depth":7,"bounds":{"left":0.9368351,"top":0.16919394,"width":0.017952127,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.16919394,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db","depth":7,"bounds":{"left":0.5827792,"top":0.18515563,"width":0.023936171,"height":0.012769354},"on_screen":true,"value":"archive.db","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"bounds":{"left":0.8656915,"top":0.18515563,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"800 MB","depth":7,"bounds":{"left":0.9375,"top":0.18515563,"width":0.017287234,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.18515563,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"#recycle","depth":7,"bounds":{"left":0.5827792,"top":0.20111732,"width":0.019946808,"height":0.012769354},"on_screen":true,"value":"#recycle","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:16","depth":7,"bounds":{"left":0.8656915,"top":0.20111732,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"70,01 GB","depth":7,"bounds":{"left":0.93417555,"top":0.20111732,"width":0.020611702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.20111732,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync.sh","depth":7,"bounds":{"left":0.5827792,"top":0.21707901,"width":0.04288564,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 11:20","depth":7,"bounds":{"left":0.8656915,"top":0.21707901,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"9 KB","depth":7,"bounds":{"left":0.9438165,"top":0.21707901,"width":0.010970744,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.21707901,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"lib","depth":7,"bounds":{"left":0.5827792,"top":0.2330407,"width":0.0076462766,"height":0.012769354},"on_screen":true,"value":"lib","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:24","depth":7,"bounds":{"left":0.8656915,"top":0.2330407,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Zero bytes","depth":7,"bounds":{"left":0.9305186,"top":0.2330407,"width":0.024268618,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":7,"bounds":{"left":0.9581117,"top":0.2330407,"width":0.014295213,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync_old.sh","depth":7,"bounds":{"left":0.5827792,"top":0.2490024,"width":0.051529255,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync_old.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 10:22","depth":7,"bounds":{"left":0.8656915,"top":0.2490024,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"18 KB","depth":7,"bounds":{"left":0.9411569,"top":0.2490024,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.2490024,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite-shm","depth":7,"bounds":{"left":0.5827792,"top":0.26496407,"width":0.030585106,"height":0.012769354},"on_screen":true,"value":"db.sqlite-shm","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 9:35","depth":7,"bounds":{"left":0.8656915,"top":0.26496407,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"33 KB","depth":7,"bounds":{"left":0.9411569,"top":0.26496407,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.26496407,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync copy.sh","depth":7,"bounds":{"left":0.5827792,"top":0.28092578,"width":0.053523935,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync copy.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 21:20","depth":7,"bounds":{"left":0.8656915,"top":0.28092578,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"15 KB","depth":7,"bounds":{"left":0.9411569,"top":0.28092578,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.28092578,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_fts_migrate.sh","depth":7,"bounds":{"left":0.5827792,"top":0.29688746,"width":0.05651596,"height":0.012769354},"on_screen":true,"value":"screenpipe_fts_migrate.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 20:25","depth":7,"bounds":{"left":0.8656915,"top":0.29688746,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"9 KB","depth":7,"bounds":{"left":0.9438165,"top":0.29688746,"width":0.010970744,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.29688746,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"db.sqlite","depth":7,"bounds":{"left":0.5827792,"top":0.31284916,"width":0.020279255,"height":0.012769354},"on_screen":true,"value":"db.sqlite","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 17:41","depth":7,"bounds":{"left":0.8656915,"top":0.31284916,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4,46 GB","depth":7,"bounds":{"left":0.9368351,"top":0.31284916,"width":0.017952127,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.31284916,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db.bak-pre-installid","depth":7,"bounds":{"left":0.5827792,"top":0.32881084,"width":0.05817819,"height":0.012769354},"on_screen":true,"value":"archive.db.bak-pre-installid","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Yesterday at 15:20","depth":7,"bounds":{"left":0.8656915,"top":0.32881084,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"12,92 GB","depth":7,"bounds":{"left":0.93417555,"top":0.32881084,"width":0.020611702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.32881084,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"screenpipe_sync_updated.sh","depth":7,"bounds":{"left":0.5827792,"top":0.34477255,"width":0.061835106,"height":0.012769354},"on_screen":true,"value":"screenpipe_sync_updated.sh","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 13:06","depth":7,"bounds":{"left":0.8656915,"top":0.34477255,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"20 KB","depth":7,"bounds":{"left":0.9411569,"top":0.34477255,"width":0.013630319,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Terminal scripts","depth":7,"bounds":{"left":0.9581117,"top":0.34477255,"width":0.03357713,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"archive.db-bak","depth":7,"bounds":{"left":0.5827792,"top":0.36073422,"width":0.03324468,"height":0.012769354},"on_screen":true,"value":"archive.db-bak","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"10 May 2026 at 12:31","depth":7,"bounds":{"left":0.8656915,"top":0.36073422,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"11,13 GB","depth":7,"bounds":{"left":0.93417555,"top":0.36073422,"width":0.020611702,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Document","depth":7,"bounds":{"left":0.9581117,"top":0.36073422,"width":0.023603724,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"app","depth":7,"bounds":{"left":0.5827792,"top":0.37669593,"width":0.010305851,"height":0.012769354},"on_screen":true,"value":"app","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"26 Apr 2026 at 20:10","depth":7,"bounds":{"left":0.8656915,"top":0.37669593,"width":0.056848403,"height":0.012769354},"on_screen":true,"role_description":"text"}]...
|
-3272800483953272132
|
-8678286927157494038
|
click
|
accessibility
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
Name
Date Modified
Size
Kind
logs
Today at 12:20
1,4 MB
Folder
screenpipe.2026-05-12.0.log
Yesterday at 21:46
294 KB
Log File
screenpipe.2026-05-11.0.log
11 May 2026 at 22:54
529 KB
Log File
sync.log
10 May 2026 at 13:47
7 KB
Log File
screenpipe.2026-05-07.0.log
7 May 2026 at 21:50
566 KB
Log File
data
Today at 12:16
7,99 GB
Folder
archive.db
Today at 12:16
800 MB
Document
#recycle
Today at 12:16
70,01 GB
Folder
screenpipe_sync.sh
Today at 11:20
9 KB
Terminal scripts
lib
Today at 10:24
Zero bytes
Folder
screenpipe_sync_old.sh
Today at 10:22
18 KB
Terminal scripts
db.sqlite-shm
Today at 9:35
33 KB
Document
screenpipe_sync copy.sh
Yesterday at 21:20
15 KB
Terminal scripts
screenpipe_fts_migrate.sh
Yesterday at 20:25
9 KB
Terminal scripts
db.sqlite
Yesterday at 17:41
4,46 GB
Document
archive.db.bak-pre-installid
Yesterday at 15:20
12,92 GB
Document
screenpipe_sync_updated.sh
10 May 2026 at 13:06
20 KB
Terminal scripts
archive.db-bak
10 May 2026 at 12:31
11,13 GB
Document
app
26 Apr 2026 at 20:10...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32445
|
1249
|
13
|
2026-05-13T09:22:39.109949+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664159109_m2.jpg...
|
Finder
|
data
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
soundcore AeroClip (input)_2026-05-13_09-21-53.mp4
Today at 12:22
30 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-21-21.mp4
Today at 12:21
17 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-20-28.mp4
Today at 12:20
10 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-19-58.mp4...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"Favourites","depth":6,"bounds":{"left":0.004654255,"top":0.061452515,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"jiminny","depth":6,"bounds":{"left":0.012632979,"top":0.08140463,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"AirDrop","depth":6,"bounds":{"left":0.012632979,"top":0.103751,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Recents","depth":6,"bounds":{"left":0.012632979,"top":0.12609737,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Applications","depth":6,"bounds":{"left":0.012632979,"top":0.14844373,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Documents","depth":6,"bounds":{"left":0.012632979,"top":0.1707901,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Downloads","depth":6,"bounds":{"left":0.012632979,"top":0.19313647,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas","depth":6,"bounds":{"left":0.012632979,"top":0.21548285,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"iCloud","depth":6,"bounds":{"left":0.004654255,"top":0.2434158,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"iCloud Drive","depth":6,"bounds":{"left":0.012632979,"top":0.26336792,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Sync folder","depth":6,"bounds":{"left":0.012632979,"top":0.2857143,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Locations","depth":6,"bounds":{"left":0.004654255,"top":0.31364724,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"DXP4800PLUS-B5F","depth":6,"bounds":{"left":0.012632979,"top":0.33359936,"width":0.043218084,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Eject","depth":6,"bounds":{"left":0.05651596,"top":0.33519554,"width":0.0043218085,"height":0.009577015},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"Network","depth":6,"bounds":{"left":0.012632979,"top":0.35594574,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Tags","depth":6,"bounds":{"left":0.004654255,"top":0.38387868,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"CRM","depth":6,"bounds":{"left":0.012632979,"top":0.4038308,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Orange","depth":6,"bounds":{"left":0.012632979,"top":0.42617717,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Red","depth":6,"bounds":{"left":0.012632979,"top":0.44852355,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yellow","depth":6,"bounds":{"left":0.012632979,"top":0.4708699,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Green","depth":6,"bounds":{"left":0.012632979,"top":0.49321628,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Blue","depth":6,"bounds":{"left":0.012632979,"top":0.51556265,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Purple","depth":6,"bounds":{"left":0.012632979,"top":0.53790903,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"All Tags…","depth":6,"bounds":{"left":0.012632979,"top":0.5602554,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-21-53.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-21-53.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:22","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"30 KB","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-21-21.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-21-21.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:21","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"17 KB","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-20-28.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-20-28.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"10 KB","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-19-58.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-19-58.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
4080987364987017194
|
-6885257996509546728
|
visual_change
|
accessibility
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
soundcore AeroClip (input)_2026-05-13_09-21-53.mp4
Today at 12:22
30 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-21-21.mp4
Today at 12:21
17 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-20-28.mp4
Today at 12:20
10 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-19-58.mp4...
|
32444
|
NULL
|
NULL
|
NULL
|
|
32446
|
1248
|
11
|
2026-05-13T09:22:39.763197+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664159763_m1.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
#recycle
screenpipe
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":26,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"#recycle","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":26,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"on_screen":true},{"role":"AXStaticText","text":"","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"on_screen":true,"role_description":"text"}]...
|
-600166403061457843
|
8646680302621753418
|
app_switch
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
#recycle
screenpipe
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32447
|
1249
|
14
|
2026-05-13T09:22:39.791270+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664159791_m2.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"bounds":{"left":0.0,"top":0.047885075,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.05586592,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"bounds":{"left":0.0,"top":0.07581804,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.083798885,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"bounds":{"left":0.0,"top":0.103751,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.11173184,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"bounds":{"left":0.0,"top":0.13168396,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.1396648,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"bounds":{"left":0.0,"top":0.15961692,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"bounds":{"left":0.0,"top":0.18754987,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.19553073,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"bounds":{"left":0.0,"top":0.21548285,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.22346368,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"bounds":{"left":0.0,"top":0.2434158,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.25139666,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"bounds":{"left":0.01462766,"top":0.047885075,"width":0.013630319,"height":0.023144454},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"bounds":{"left":0.01462766,"top":0.054269753,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.014960106,"top":0.055067837,"width":0.0019946808,"height":0.008778931}},{"char_start":1,"char_count":7,"bounds":{"left":0.016954787,"top":0.055067837,"width":0.011303191,"height":0.008778931}}],"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"bounds":{"left":0.011635638,"top":0.07102953,"width":0.0831117,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.0726257,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"bounds":{"left":0.016954787,"top":0.07102953,"width":0.035904255,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"bounds":{"left":0.016954787,"top":0.07342378,"width":0.035904255,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.07342378,"width":0.0019946808,"height":0.009577015}},{"char_start":1,"char_count":20,"bounds":{"left":0.018949468,"top":0.07342378,"width":0.034242023,"height":0.009577015}}],"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"bounds":{"left":0.019614361,"top":0.08699122,"width":0.0039893617,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"bounds":{"left":0.025930852,"top":0.08699122,"width":0.01861702,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.025930852,"top":0.087789305,"width":0.0019946808,"height":0.0103751}},{"char_start":1,"char_count":9,"bounds":{"left":0.027925532,"top":0.087789305,"width":0.016954787,"height":0.0103751}}],"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"bounds":{"left":0.011635638,"top":0.95530725,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.95690346,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"bounds":{"left":0.016954787,"top":0.95530725,"width":0.011635638,"height":0.015163607},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"bounds":{"left":0.016954787,"top":0.9577015,"width":0.011635638,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9584996,"width":0.0026595744,"height":0.009577015}},{"char_start":1,"char_count":6,"bounds":{"left":0.019946808,"top":0.9584996,"width":0.008976064,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"bounds":{"left":0.011635638,"top":0.9696728,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.97206706,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"bounds":{"left":0.016954787,"top":0.97047085,"width":0.013630319,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"bounds":{"left":0.016954787,"top":0.9728651,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9728651,"width":0.0023271276,"height":0.009577015}},{"char_start":1,"char_count":7,"bounds":{"left":0.019281914,"top":0.9728651,"width":0.011635638,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"bounds":{"left":0.0016622341,"top":0.9848364,"width":0.054853722,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.0039893617,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"bounds":{"left":0.00831117,"top":0.98723066,"width":0.046210106,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.008643617,"top":0.98723066,"width":0.0009973404,"height":0.009577015}},{"char_start":1,"char_count":25,"bounds":{"left":0.009640957,"top":0.98723066,"width":0.043218084,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"bounds":{"left":0.05718085,"top":0.9848364,"width":0.018949468,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.05851064,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.0631649,"top":0.98723066,"width":0.0039893617,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.06715426,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.071476065,"top":0.98723066,"width":0.0033244682,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"bounds":{"left":0.0774601,"top":0.9848364,"width":0.010638298,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.07912234,"top":0.98643255,"width":0.0043218085,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"bounds":{"left":0.08344415,"top":0.98723066,"width":0.0029920214,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"bounds":{"left":0.99102396,"top":0.9848364,"width":0.008976042,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"bounds":{"left":0.9694149,"top":0.9848364,"width":0.020944148,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"bounds":{"left":0.96110374,"top":0.9848364,"width":0.006981383,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"bounds":{"left":0.9468085,"top":0.9848364,"width":0.012965426,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"bounds":{"left":0.9268617,"top":0.9848364,"width":0.018284574,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"bounds":{"left":0.90325797,"top":0.9848364,"width":0.021941489,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"bounds":{"left":0.8580452,"top":0.9848364,"width":0.04454787,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"bounds":{"left":0.76163566,"top":0.05347167,"width":0.034574468,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.76163566,"top":0.054269753,"width":0.0023271276,"height":0.0103751}},{"char_start":1,"char_count":19,"bounds":{"left":0.76396275,"top":0.054269753,"width":0.032247342,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23238032,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9840425,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.98603725,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.9886968,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.99035907,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"bounds":{"left":0.80418885,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.84075797,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"bounds":{"left":0.7652925,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76828456,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"bounds":{"left":0.7849069,"top":0.07102953,"width":0.04720745,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.83211434,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"bounds":{"left":0.87765956,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8962766,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23071809,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"bounds":{"left":0.8543883,"top":0.07102953,"width":0.04288564,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"bounds":{"left":0.9012633,"top":0.07102953,"width":0.031914894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"bounds":{"left":0.9338431,"top":0.07102953,"width":0.059175532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.9175532,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"bounds":{"left":0.76961434,"top":0.07102953,"width":0.047539894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.09009308,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"bounds":{"left":0.7869016,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.005984043,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.79886967,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"bounds":{"left":0.8068484,"top":0.07102953,"width":0.013962766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"bounds":{"left":0.82081115,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"bounds":{"left":0.8287899,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"bounds":{"left":0.8507314,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"bounds":{"left":0.87267286,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"bounds":{"left":0.87898934,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"bounds":{"left":0.7805851,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"bounds":{"left":0.78291225,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"bounds":{"left":0.80485374,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.029920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"bounds":{"left":0.79288566,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"bounds":{"left":0.83144945,"top":0.07102953,"width":0.07646277,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9075798,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90890956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.91422874,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.953125,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.9617686,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.9674202,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"bounds":{"left":0.9740692,"top":0.07102953,"width":0.011968086,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23138298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"bounds":{"left":0.7898936,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045212764,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.068484046,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"}]...
|
3082363765264932323
|
8556010174721247439
|
app_switch
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32448
|
1249
|
15
|
2026-05-13T09:22:40.521725+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664160521_m2.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"bounds":{"left":0.0,"top":0.047885075,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.05586592,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"bounds":{"left":0.0,"top":0.07581804,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.083798885,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"bounds":{"left":0.0,"top":0.103751,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.11173184,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"bounds":{"left":0.0,"top":0.13168396,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.1396648,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"bounds":{"left":0.0,"top":0.15961692,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"bounds":{"left":0.0,"top":0.18754987,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.19553073,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"bounds":{"left":0.0,"top":0.21548285,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.22346368,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"bounds":{"left":0.0,"top":0.2434158,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.25139666,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"bounds":{"left":0.01462766,"top":0.047885075,"width":0.013630319,"height":0.023144454},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"bounds":{"left":0.01462766,"top":0.054269753,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.014960106,"top":0.055067837,"width":0.0019946808,"height":0.008778931}},{"char_start":1,"char_count":7,"bounds":{"left":0.016954787,"top":0.055067837,"width":0.011303191,"height":0.008778931}}],"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"bounds":{"left":0.011635638,"top":0.07102953,"width":0.0831117,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.0726257,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"bounds":{"left":0.016954787,"top":0.07102953,"width":0.035904255,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"bounds":{"left":0.016954787,"top":0.07342378,"width":0.035904255,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.07342378,"width":0.0019946808,"height":0.009577015}},{"char_start":1,"char_count":20,"bounds":{"left":0.018949468,"top":0.07342378,"width":0.034242023,"height":0.009577015}}],"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"bounds":{"left":0.019614361,"top":0.08699122,"width":0.0039893617,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"bounds":{"left":0.025930852,"top":0.08699122,"width":0.01861702,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.025930852,"top":0.087789305,"width":0.0019946808,"height":0.0103751}},{"char_start":1,"char_count":9,"bounds":{"left":0.027925532,"top":0.087789305,"width":0.016954787,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"bounds":{"left":0.08909574,"top":0.087789305,"width":0.0013297872,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"bounds":{"left":0.011635638,"top":0.95530725,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.95690346,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"bounds":{"left":0.016954787,"top":0.95530725,"width":0.011635638,"height":0.015163607},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"bounds":{"left":0.016954787,"top":0.9577015,"width":0.011635638,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9584996,"width":0.0026595744,"height":0.009577015}},{"char_start":1,"char_count":6,"bounds":{"left":0.019946808,"top":0.9584996,"width":0.008976064,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"bounds":{"left":0.011635638,"top":0.9696728,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.97206706,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"bounds":{"left":0.016954787,"top":0.97047085,"width":0.013630319,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"bounds":{"left":0.016954787,"top":0.9728651,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9728651,"width":0.0023271276,"height":0.009577015}},{"char_start":1,"char_count":7,"bounds":{"left":0.019281914,"top":0.9728651,"width":0.011635638,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"bounds":{"left":0.0016622341,"top":0.9848364,"width":0.054853722,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.0039893617,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"bounds":{"left":0.00831117,"top":0.98723066,"width":0.046210106,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.008643617,"top":0.98723066,"width":0.0009973404,"height":0.009577015}},{"char_start":1,"char_count":25,"bounds":{"left":0.009640957,"top":0.98723066,"width":0.043218084,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"bounds":{"left":0.05718085,"top":0.9848364,"width":0.018949468,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.05851064,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.0631649,"top":0.98723066,"width":0.0039893617,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.06715426,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.071476065,"top":0.98723066,"width":0.0033244682,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"bounds":{"left":0.0774601,"top":0.9848364,"width":0.010638298,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.07912234,"top":0.98643255,"width":0.0043218085,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"bounds":{"left":0.08344415,"top":0.98723066,"width":0.0029920214,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"bounds":{"left":0.99102396,"top":0.9848364,"width":0.008976042,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"bounds":{"left":0.9694149,"top":0.9848364,"width":0.020944148,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"bounds":{"left":0.96110374,"top":0.9848364,"width":0.006981383,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"bounds":{"left":0.9468085,"top":0.9848364,"width":0.012965426,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"bounds":{"left":0.9268617,"top":0.9848364,"width":0.018284574,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"bounds":{"left":0.90325797,"top":0.9848364,"width":0.021941489,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"bounds":{"left":0.8580452,"top":0.9848364,"width":0.04454787,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"bounds":{"left":0.76163566,"top":0.05347167,"width":0.034574468,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.76163566,"top":0.054269753,"width":0.0023271276,"height":0.0103751}},{"char_start":1,"char_count":19,"bounds":{"left":0.76396275,"top":0.054269753,"width":0.032247342,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23238032,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9840425,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.98603725,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.9886968,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.99035907,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"bounds":{"left":0.80418885,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.84075797,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"bounds":{"left":0.7652925,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76828456,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"bounds":{"left":0.7849069,"top":0.07102953,"width":0.04720745,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.83211434,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"bounds":{"left":0.87765956,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8962766,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23071809,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"bounds":{"left":0.8543883,"top":0.07102953,"width":0.04288564,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"bounds":{"left":0.9012633,"top":0.07102953,"width":0.031914894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"bounds":{"left":0.9338431,"top":0.07102953,"width":0.059175532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.9175532,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"bounds":{"left":0.76961434,"top":0.07102953,"width":0.047539894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.09009308,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"bounds":{"left":0.7869016,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.005984043,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.79886967,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"bounds":{"left":0.8068484,"top":0.07102953,"width":0.013962766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"bounds":{"left":0.82081115,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"bounds":{"left":0.8287899,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"bounds":{"left":0.8507314,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"bounds":{"left":0.87267286,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"bounds":{"left":0.87898934,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"bounds":{"left":0.7805851,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"bounds":{"left":0.78291225,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"bounds":{"left":0.80485374,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.029920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"bounds":{"left":0.79288566,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"bounds":{"left":0.83144945,"top":0.07102953,"width":0.07646277,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9075798,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90890956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.91422874,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.953125,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.9617686,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.9674202,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"bounds":{"left":0.9740692,"top":0.07102953,"width":0.011968086,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23138298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"bounds":{"left":0.7898936,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045212764,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.068484046,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.027925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.80086434,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"bounds":{"left":0.81648934,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8380984,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8390958,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.84474736,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.8836436,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.89228725,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"bounds":{"left":0.90425533,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9428192,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19913563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.034242023,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03723404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0787899,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.053856384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.026928192,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.038231384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.041223403,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.078457445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.05285904,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.027260639,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"bounds":{"left":0.8088431,"top":0.07102953,"width":0.08976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"bounds":{"left":0.90525264,"top":0.07102953,"width":0.03856383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.94481385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.032579787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.016954787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"bounds":{"left":0.78956115,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"bounds":{"left":0.82047874,"top":0.07102953,"width":0.025930852,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"bounds":{"left":0.84640956,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"bounds":{"left":0.8680186,"top":0.07102953,"width":0.024933511,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"bounds":{"left":0.7915558,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"bounds":{"left":0.8075133,"top":0.07102953,"width":0.080784574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"bounds":{"left":0.88829786,"top":0.07102953,"width":0.043550532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"bounds":{"left":0.9318484,"top":0.07102953,"width":0.008643617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.09707447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"bounds":{"left":0.78224736,"top":0.07102953,"width":0.04155585,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.07180851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"bounds":{"left":0.84275264,"top":0.07102953,"width":0.036236703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.032912236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"bounds":{"left":0.81150264,"top":0.07102953,"width":0.07081117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"bounds":{"left":0.88231385,"top":0.07102953,"width":0.066821806,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"bounds":{"left":0.80518615,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.023603724,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.017287234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.025598405,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"bounds":{"left":0.8194814,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"bounds":{"left":0.8856383,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"bounds":{"left":0.92486703,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19448139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10571808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.08543883,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09042553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.109042555,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13198139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09674202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10804521,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09275266,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13464096,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13231383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11735372,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1306516,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12765957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.094082445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10006649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12566489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12333777,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07912234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07712766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11868351,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.120678194,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1263298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12034574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.006981383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"bounds":{"left":0.7699468,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.7922208,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"bounds":{"left":0.79421544,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"bounds":{"left":0.81017286,"top":0.07102953,"width":0.06715426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"bounds":{"left":0.87732714,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.93550533,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"bounds":{"left":0.9375,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.22174202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"bounds":{"left":0.7819149,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.84574467,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.84707445,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.8523936,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.004654255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9025931,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90359044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"}]...
|
869622186278339599
|
7426022362047245507
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or...
|
32447
|
NULL
|
NULL
|
NULL
|
|
32449
|
1248
|
12
|
2026-05-13T09:22:40.529850+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664160529_m1.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash
cat
~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
The error shows
screenpipe_sync_helpers.s
(missing 'h'), which
suggests a file corruption or incomplete copy. Verify
all three lib files were
copied intact:
bash
ls
-la
~/.screenpipe/scripts/lib/
If the
helpers file is corrupted or empty
, copy it again from the NAS.
Feedback submitted...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sources","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", they use their own directory (","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"already inside","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"), causing the path to be doubled","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fix: Use","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"unique variable names in lib","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"modules to avoid conflicts:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fixed. The","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issue was that the","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib modules were over","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"writing the main script's","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable. I renamed it","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"in both","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to avoid conflicts.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Try running","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script again:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"db_init_tables() {","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"run_sqlite_heredoc creating: No such file or directory","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The error shows the","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source command is failing and the script is","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"trying to execute function definitions as commands. Check","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"if the helpers file was copied correctly to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"your Mac:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cat","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The error shows","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.s","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(missing 'h'), which","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"suggests a file corruption or incomplete copy. Verify","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"all three lib files were","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copied intact:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ls","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-la","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~/.screenpipe/scripts/lib/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"If the","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"helpers file is corrupted or empty","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", copy it again from the NAS.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"}]...
|
4354636978251690602
|
2849802182095531211
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash
cat
~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
The error shows
screenpipe_sync_helpers.s
(missing 'h'), which
suggests a file corruption or incomplete copy. Verify
all three lib files were
copied intact:
bash
ls
-la
~/.screenpipe/scripts/lib/
If the
helpers file is corrupted or empty
, copy it again from the NAS.
Feedback submitted...
|
32446
|
NULL
|
NULL
|
NULL
|
|
32450
|
1248
|
13
|
2026-05-13T09:22:41.341545+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664161341_m1.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sources","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", they use their own directory (","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"already inside","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"), causing the path to be doubled","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fix: Use","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"unique variable names in lib","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"modules to avoid conflicts:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fixed. The","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issue was that the","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib modules were over","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"writing the main script's","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable. I renamed it","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"in both","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to avoid conflicts.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Try running","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script again:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"db_init_tables() {","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"run_sqlite_heredoc creating: No such file or directory","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The error shows the","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source command is failing and the script is","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"trying to execute function definitions as commands. Check","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"if the helpers file was copied correctly to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"your Mac:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"}]...
|
3143791062333098686
|
2850653204095397071
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32451
|
1249
|
16
|
2026-05-13T09:22:41.341563+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664161341_m2.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"bounds":{"left":0.0,"top":0.047885075,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.05586592,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"bounds":{"left":0.0,"top":0.07581804,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.083798885,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"bounds":{"left":0.0,"top":0.103751,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.11173184,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"bounds":{"left":0.0,"top":0.13168396,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.1396648,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"bounds":{"left":0.0,"top":0.15961692,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"bounds":{"left":0.0,"top":0.18754987,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.19553073,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"bounds":{"left":0.0,"top":0.21548285,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.22346368,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"bounds":{"left":0.0,"top":0.2434158,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.25139666,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"bounds":{"left":0.01462766,"top":0.047885075,"width":0.013630319,"height":0.023144454},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"bounds":{"left":0.01462766,"top":0.054269753,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.014960106,"top":0.055067837,"width":0.0019946808,"height":0.008778931}},{"char_start":1,"char_count":7,"bounds":{"left":0.016954787,"top":0.055067837,"width":0.011303191,"height":0.008778931}}],"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"bounds":{"left":0.011635638,"top":0.07102953,"width":0.0831117,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.0726257,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"bounds":{"left":0.016954787,"top":0.07102953,"width":0.035904255,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"bounds":{"left":0.016954787,"top":0.07342378,"width":0.035904255,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.07342378,"width":0.0019946808,"height":0.009577015}},{"char_start":1,"char_count":20,"bounds":{"left":0.018949468,"top":0.07342378,"width":0.034242023,"height":0.009577015}}],"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"bounds":{"left":0.019614361,"top":0.08699122,"width":0.0039893617,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"bounds":{"left":0.025930852,"top":0.08699122,"width":0.01861702,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.025930852,"top":0.087789305,"width":0.0019946808,"height":0.0103751}},{"char_start":1,"char_count":9,"bounds":{"left":0.027925532,"top":0.087789305,"width":0.016954787,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"bounds":{"left":0.08909574,"top":0.087789305,"width":0.0013297872,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"bounds":{"left":0.011635638,"top":0.95530725,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.95690346,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"bounds":{"left":0.016954787,"top":0.95530725,"width":0.011635638,"height":0.015163607},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"bounds":{"left":0.016954787,"top":0.9577015,"width":0.011635638,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9584996,"width":0.0026595744,"height":0.009577015}},{"char_start":1,"char_count":6,"bounds":{"left":0.019946808,"top":0.9584996,"width":0.008976064,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"bounds":{"left":0.011635638,"top":0.9696728,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.97206706,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"bounds":{"left":0.016954787,"top":0.97047085,"width":0.013630319,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"bounds":{"left":0.016954787,"top":0.9728651,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9728651,"width":0.0023271276,"height":0.009577015}},{"char_start":1,"char_count":7,"bounds":{"left":0.019281914,"top":0.9728651,"width":0.011635638,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"bounds":{"left":0.0016622341,"top":0.9848364,"width":0.054853722,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.0039893617,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"bounds":{"left":0.00831117,"top":0.98723066,"width":0.046210106,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.008643617,"top":0.98723066,"width":0.0009973404,"height":0.009577015}},{"char_start":1,"char_count":25,"bounds":{"left":0.009640957,"top":0.98723066,"width":0.043218084,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"bounds":{"left":0.05718085,"top":0.9848364,"width":0.018949468,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.05851064,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.0631649,"top":0.98723066,"width":0.0039893617,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.06715426,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.071476065,"top":0.98723066,"width":0.0033244682,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"bounds":{"left":0.0774601,"top":0.9848364,"width":0.010638298,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.07912234,"top":0.98643255,"width":0.0043218085,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"bounds":{"left":0.08344415,"top":0.98723066,"width":0.0029920214,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"bounds":{"left":0.99102396,"top":0.9848364,"width":0.008976042,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"bounds":{"left":0.9694149,"top":0.9848364,"width":0.020944148,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"bounds":{"left":0.96110374,"top":0.9848364,"width":0.006981383,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"bounds":{"left":0.9468085,"top":0.9848364,"width":0.012965426,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"bounds":{"left":0.9268617,"top":0.9848364,"width":0.018284574,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"bounds":{"left":0.90325797,"top":0.9848364,"width":0.021941489,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"bounds":{"left":0.8580452,"top":0.9848364,"width":0.04454787,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"bounds":{"left":0.76163566,"top":0.05347167,"width":0.034574468,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.76163566,"top":0.054269753,"width":0.0023271276,"height":0.0103751}},{"char_start":1,"char_count":19,"bounds":{"left":0.76396275,"top":0.054269753,"width":0.032247342,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23238032,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9840425,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.98603725,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.9886968,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.99035907,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"bounds":{"left":0.80418885,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.84075797,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"bounds":{"left":0.7652925,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76828456,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"bounds":{"left":0.7849069,"top":0.07102953,"width":0.04720745,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.83211434,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"bounds":{"left":0.87765956,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8962766,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23071809,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"bounds":{"left":0.8543883,"top":0.07102953,"width":0.04288564,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"bounds":{"left":0.9012633,"top":0.07102953,"width":0.031914894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"bounds":{"left":0.9338431,"top":0.07102953,"width":0.059175532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.9175532,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"bounds":{"left":0.76961434,"top":0.07102953,"width":0.047539894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.09009308,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"bounds":{"left":0.7869016,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.005984043,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.79886967,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"bounds":{"left":0.8068484,"top":0.07102953,"width":0.013962766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"bounds":{"left":0.82081115,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"bounds":{"left":0.8287899,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"bounds":{"left":0.8507314,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"bounds":{"left":0.87267286,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"bounds":{"left":0.87898934,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"bounds":{"left":0.7805851,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"bounds":{"left":0.78291225,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"bounds":{"left":0.80485374,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.029920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"bounds":{"left":0.79288566,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"bounds":{"left":0.83144945,"top":0.07102953,"width":0.07646277,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9075798,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90890956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.91422874,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.953125,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.9617686,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.9674202,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"bounds":{"left":0.9740692,"top":0.07102953,"width":0.011968086,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23138298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"bounds":{"left":0.7898936,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045212764,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.068484046,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.027925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.80086434,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"bounds":{"left":0.81648934,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8380984,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8390958,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.84474736,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.8836436,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.89228725,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"bounds":{"left":0.90425533,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9428192,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19913563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.034242023,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03723404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0787899,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.053856384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.026928192,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.038231384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.041223403,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.078457445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.05285904,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.027260639,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"bounds":{"left":0.8088431,"top":0.07102953,"width":0.08976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"bounds":{"left":0.90525264,"top":0.07102953,"width":0.03856383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.94481385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.032579787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.016954787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"bounds":{"left":0.78956115,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"bounds":{"left":0.82047874,"top":0.07102953,"width":0.025930852,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"bounds":{"left":0.84640956,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"bounds":{"left":0.8680186,"top":0.07102953,"width":0.024933511,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"bounds":{"left":0.7915558,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"bounds":{"left":0.8075133,"top":0.07102953,"width":0.080784574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"bounds":{"left":0.88829786,"top":0.07102953,"width":0.043550532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"bounds":{"left":0.9318484,"top":0.07102953,"width":0.008643617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.09707447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"bounds":{"left":0.78224736,"top":0.07102953,"width":0.04155585,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.07180851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"bounds":{"left":0.84275264,"top":0.07102953,"width":0.036236703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.032912236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"bounds":{"left":0.81150264,"top":0.07102953,"width":0.07081117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"bounds":{"left":0.88231385,"top":0.07102953,"width":0.066821806,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"bounds":{"left":0.80518615,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.023603724,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.017287234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.025598405,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"bounds":{"left":0.8194814,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"bounds":{"left":0.8856383,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"bounds":{"left":0.92486703,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19448139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10571808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.08543883,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09042553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.109042555,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13198139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09674202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10804521,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09275266,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13464096,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13231383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11735372,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1306516,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12765957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.094082445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10006649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12566489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12333777,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07912234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07712766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11868351,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.120678194,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1263298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12034574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.006981383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"bounds":{"left":0.7699468,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.7922208,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"bounds":{"left":0.79421544,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"bounds":{"left":0.81017286,"top":0.07102953,"width":0.06715426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"bounds":{"left":0.87732714,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.93550533,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"bounds":{"left":0.9375,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.22174202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"bounds":{"left":0.7819149,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.84574467,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.84707445,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"}]...
|
2741590140618233243
|
7353973564102339779
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32452
|
1248
|
14
|
2026-05-13T09:22:44.514860+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664164514_m1.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sources","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", they use their own directory (","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"already inside","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"), causing the path to be doubled","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fix: Use","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"unique variable names in lib","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"modules to avoid conflicts:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"}]...
|
9122916921193676907
|
2778316334104046795
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(...
|
32450
|
NULL
|
NULL
|
NULL
|
|
32453
|
1249
|
17
|
2026-05-13T09:22:44.538853+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664164538_m2.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"bounds":{"left":0.0,"top":0.047885075,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.05586592,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"bounds":{"left":0.0,"top":0.07581804,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.083798885,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"bounds":{"left":0.0,"top":0.103751,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.11173184,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"bounds":{"left":0.0,"top":0.13168396,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.1396648,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"bounds":{"left":0.0,"top":0.15961692,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"bounds":{"left":0.0,"top":0.18754987,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.19553073,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"bounds":{"left":0.0,"top":0.21548285,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.22346368,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"bounds":{"left":0.0,"top":0.2434158,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.25139666,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"bounds":{"left":0.01462766,"top":0.047885075,"width":0.013630319,"height":0.023144454},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"bounds":{"left":0.01462766,"top":0.054269753,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.014960106,"top":0.055067837,"width":0.0019946808,"height":0.008778931}},{"char_start":1,"char_count":7,"bounds":{"left":0.016954787,"top":0.055067837,"width":0.011303191,"height":0.008778931}}],"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"bounds":{"left":0.011635638,"top":0.07102953,"width":0.0831117,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.0726257,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"bounds":{"left":0.016954787,"top":0.07102953,"width":0.035904255,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"bounds":{"left":0.016954787,"top":0.07342378,"width":0.035904255,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.07342378,"width":0.0019946808,"height":0.009577015}},{"char_start":1,"char_count":20,"bounds":{"left":0.018949468,"top":0.07342378,"width":0.034242023,"height":0.009577015}}],"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"bounds":{"left":0.019614361,"top":0.08699122,"width":0.0039893617,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"bounds":{"left":0.025930852,"top":0.08699122,"width":0.01861702,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.025930852,"top":0.087789305,"width":0.0019946808,"height":0.0103751}},{"char_start":1,"char_count":9,"bounds":{"left":0.027925532,"top":0.087789305,"width":0.016954787,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"bounds":{"left":0.08909574,"top":0.087789305,"width":0.0013297872,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"bounds":{"left":0.011635638,"top":0.95530725,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.95690346,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"bounds":{"left":0.016954787,"top":0.95530725,"width":0.011635638,"height":0.015163607},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"bounds":{"left":0.016954787,"top":0.9577015,"width":0.011635638,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9584996,"width":0.0026595744,"height":0.009577015}},{"char_start":1,"char_count":6,"bounds":{"left":0.019946808,"top":0.9584996,"width":0.008976064,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"bounds":{"left":0.011635638,"top":0.9696728,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.97206706,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"bounds":{"left":0.016954787,"top":0.97047085,"width":0.013630319,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"bounds":{"left":0.016954787,"top":0.9728651,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9728651,"width":0.0023271276,"height":0.009577015}},{"char_start":1,"char_count":7,"bounds":{"left":0.019281914,"top":0.9728651,"width":0.011635638,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"bounds":{"left":0.0016622341,"top":0.9848364,"width":0.054853722,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.0039893617,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"bounds":{"left":0.00831117,"top":0.98723066,"width":0.046210106,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.008643617,"top":0.98723066,"width":0.0009973404,"height":0.009577015}},{"char_start":1,"char_count":25,"bounds":{"left":0.009640957,"top":0.98723066,"width":0.043218084,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"bounds":{"left":0.05718085,"top":0.9848364,"width":0.018949468,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.05851064,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.0631649,"top":0.98723066,"width":0.0039893617,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.06715426,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.071476065,"top":0.98723066,"width":0.0033244682,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"bounds":{"left":0.0774601,"top":0.9848364,"width":0.010638298,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.07912234,"top":0.98643255,"width":0.0043218085,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"bounds":{"left":0.08344415,"top":0.98723066,"width":0.0029920214,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"bounds":{"left":0.99102396,"top":0.9848364,"width":0.008976042,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"bounds":{"left":0.9694149,"top":0.9848364,"width":0.020944148,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"bounds":{"left":0.96110374,"top":0.9848364,"width":0.006981383,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"bounds":{"left":0.9468085,"top":0.9848364,"width":0.012965426,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"bounds":{"left":0.9268617,"top":0.9848364,"width":0.018284574,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"bounds":{"left":0.90325797,"top":0.9848364,"width":0.021941489,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"bounds":{"left":0.8580452,"top":0.9848364,"width":0.04454787,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"bounds":{"left":0.76163566,"top":0.05347167,"width":0.034574468,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.76163566,"top":0.054269753,"width":0.0023271276,"height":0.0103751}},{"char_start":1,"char_count":19,"bounds":{"left":0.76396275,"top":0.054269753,"width":0.032247342,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23238032,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9840425,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.98603725,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.9886968,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.99035907,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"bounds":{"left":0.80418885,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.84075797,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"bounds":{"left":0.7652925,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76828456,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"bounds":{"left":0.7849069,"top":0.07102953,"width":0.04720745,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.83211434,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"bounds":{"left":0.87765956,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8962766,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23071809,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"bounds":{"left":0.8543883,"top":0.07102953,"width":0.04288564,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"bounds":{"left":0.9012633,"top":0.07102953,"width":0.031914894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"bounds":{"left":0.9338431,"top":0.07102953,"width":0.059175532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.9175532,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"bounds":{"left":0.76961434,"top":0.07102953,"width":0.047539894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.09009308,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"bounds":{"left":0.7869016,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.005984043,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.79886967,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"bounds":{"left":0.8068484,"top":0.07102953,"width":0.013962766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"bounds":{"left":0.82081115,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"bounds":{"left":0.8287899,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"bounds":{"left":0.8507314,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"bounds":{"left":0.87267286,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"bounds":{"left":0.87898934,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"bounds":{"left":0.7805851,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"bounds":{"left":0.78291225,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"bounds":{"left":0.80485374,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.029920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"bounds":{"left":0.79288566,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"bounds":{"left":0.83144945,"top":0.07102953,"width":0.07646277,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9075798,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90890956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.91422874,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.953125,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.9617686,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.9674202,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"bounds":{"left":0.9740692,"top":0.07102953,"width":0.011968086,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23138298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"bounds":{"left":0.7898936,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045212764,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.068484046,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.027925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.80086434,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"bounds":{"left":0.81648934,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8380984,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8390958,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.84474736,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.8836436,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.89228725,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"bounds":{"left":0.90425533,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9428192,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19913563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.034242023,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03723404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0787899,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.053856384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.026928192,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.038231384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.041223403,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.078457445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.05285904,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.027260639,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"bounds":{"left":0.8088431,"top":0.07102953,"width":0.08976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"bounds":{"left":0.90525264,"top":0.07102953,"width":0.03856383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.94481385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.032579787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.016954787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"bounds":{"left":0.78956115,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"bounds":{"left":0.82047874,"top":0.07102953,"width":0.025930852,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"bounds":{"left":0.84640956,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"bounds":{"left":0.8680186,"top":0.07102953,"width":0.024933511,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"bounds":{"left":0.7915558,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"bounds":{"left":0.8075133,"top":0.07102953,"width":0.080784574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"bounds":{"left":0.88829786,"top":0.07102953,"width":0.043550532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"bounds":{"left":0.9318484,"top":0.07102953,"width":0.008643617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.09707447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"bounds":{"left":0.78224736,"top":0.07102953,"width":0.04155585,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.07180851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"bounds":{"left":0.84275264,"top":0.07102953,"width":0.036236703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.032912236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"bounds":{"left":0.81150264,"top":0.07102953,"width":0.07081117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"bounds":{"left":0.88231385,"top":0.07102953,"width":0.066821806,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"bounds":{"left":0.80518615,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.023603724,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.017287234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.025598405,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"bounds":{"left":0.8194814,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"bounds":{"left":0.8856383,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"bounds":{"left":0.92486703,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19448139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10571808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.08543883,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09042553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.109042555,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13198139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09674202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10804521,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09275266,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13464096,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13231383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11735372,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1306516,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12765957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.094082445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10006649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12566489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12333777,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07912234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07712766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11868351,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.120678194,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1263298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12034574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.006981383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"bounds":{"left":0.7699468,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.7922208,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"bounds":{"left":0.79421544,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"bounds":{"left":0.81017286,"top":0.07102953,"width":0.06715426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"bounds":{"left":0.87732714,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.93550533,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"bounds":{"left":0.9375,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.22174202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"bounds":{"left":0.7819149,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.84574467,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.84707445,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.8523936,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.004654255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9025931,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90359044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.90924203,"top":0.07102953,"width":0.051861703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sources","depth":21,"bounds":{"left":0.96110374,"top":0.07102953,"width":0.015292553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.97606385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.97706115,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23038563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", they use their own directory (","depth":21,"bounds":{"left":0.80851066,"top":0.07102953,"width":0.054853722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"already inside","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.88796544,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.88896275,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89461434,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"), causing the path to be doubled","depth":21,"bounds":{"left":0.9009308,"top":0.07102953,"width":0.059507977,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9601064,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fix: Use","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"unique variable names in lib","depth":21,"bounds":{"left":0.7775931,"top":0.07102953,"width":0.050531916,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"modules to avoid conflicts:","depth":21,"bounds":{"left":0.8277925,"top":0.07102953,"width":0.04920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.039893616,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9830452,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9850399,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.98836434,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9900266,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.78390956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.7859042,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"bounds":{"left":0.7912234,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"bounds":{"left":0.81515956,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"bounds":{"left":0.8224734,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"}]...
|
1620270708032028936
|
3967257839636835531
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE...
|
32451
|
NULL
|
NULL
|
NULL
|
|
32454
|
1249
|
18
|
2026-05-13T09:22:45.133168+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664165133_m2.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash
cat
~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
The error shows
screenpipe_sync_helpers.s
(missing 'h'), which
suggests a file corruption or incomplete copy. Verify
all three lib files were
copied intact:
bash
ls
-la
~/.screenpipe/scripts/lib/
If the
helpers file is corrupted or empty
, copy it again from the NAS.
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ls -la ~/.screenpipe/scripts/lib/
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11635 13 May 11:33 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4890 13 May 11:34 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ cat ~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
#!/bin/bash
# screenpipe_sync_helpers.sh
# Helper functions for screenpipe sync scripts
# Source this file in other scripts to use the helpers
# ─── CONFIG ───────────────────────────────────────────────────────────────────
# These can be overridden by the sourcing script
SCRIPT_START=${SCRIPT_START:-$(date +%s)}
DB_SRC="${DB_SRC:-$HOME/.screenpipe/db.sqlite}"
LOG_FILE="${LOG_FILE:-$HOME/.screenpipe/sync.log}"
# ──────────────────────────────────────────────────────────────────────────────
# ─── HELPERS ──────────────────────────────────────────────────────────────────
log() {
local msg="[$(date '+%Y-%m-%d %H:%M:%S')] $*"
echo "$msg" | tee -a "$LOG_FILE"
}
step() {
local now=$(date +%s)
local elapsed=$(( now - SCRIPT_START ))
local min=$(( elapsed / 60 ))
local sec=$(( elapsed % 60 ))
printf "\n[+%02dm%02ds] ▶ %s\n" "$min" "$sec" "$*" | tee -a "$LOG_FILE"
}
run_sqlite_heredoc() {
local label="$1"
local sql="$2"
local start=$(date +%s)
Expand content to scroll
Thought
for 3s
The
helpers file looks correct. The error suggests the
source
command is failing silently. Test if
the source command works directly:
bash
cd
~/.screenpipe/scripts/lib
source...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"bounds":{"left":0.0,"top":0.047885075,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.05586592,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"bounds":{"left":0.0,"top":0.07581804,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.083798885,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"bounds":{"left":0.0,"top":0.103751,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.11173184,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"bounds":{"left":0.0,"top":0.13168396,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.1396648,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"bounds":{"left":0.0,"top":0.15961692,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"bounds":{"left":0.0,"top":0.18754987,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.19553073,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"bounds":{"left":0.0,"top":0.21548285,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.22346368,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"bounds":{"left":0.0,"top":0.2434158,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.25139666,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"bounds":{"left":0.01462766,"top":0.047885075,"width":0.013630319,"height":0.023144454},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"bounds":{"left":0.01462766,"top":0.054269753,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.014960106,"top":0.055067837,"width":0.0019946808,"height":0.008778931}},{"char_start":1,"char_count":7,"bounds":{"left":0.016954787,"top":0.055067837,"width":0.011303191,"height":0.008778931}}],"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"bounds":{"left":0.011635638,"top":0.07102953,"width":0.0831117,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.0726257,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"bounds":{"left":0.016954787,"top":0.07102953,"width":0.035904255,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"bounds":{"left":0.016954787,"top":0.07342378,"width":0.035904255,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.07342378,"width":0.0019946808,"height":0.009577015}},{"char_start":1,"char_count":20,"bounds":{"left":0.018949468,"top":0.07342378,"width":0.034242023,"height":0.009577015}}],"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"bounds":{"left":0.019614361,"top":0.08699122,"width":0.0039893617,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"bounds":{"left":0.025930852,"top":0.08699122,"width":0.01861702,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.025930852,"top":0.087789305,"width":0.0019946808,"height":0.0103751}},{"char_start":1,"char_count":9,"bounds":{"left":0.027925532,"top":0.087789305,"width":0.016954787,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"bounds":{"left":0.08909574,"top":0.087789305,"width":0.0013297872,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"bounds":{"left":0.011635638,"top":0.95530725,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.95690346,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"bounds":{"left":0.016954787,"top":0.95530725,"width":0.011635638,"height":0.015163607},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"bounds":{"left":0.016954787,"top":0.9577015,"width":0.011635638,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9584996,"width":0.0026595744,"height":0.009577015}},{"char_start":1,"char_count":6,"bounds":{"left":0.019946808,"top":0.9584996,"width":0.008976064,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"bounds":{"left":0.011635638,"top":0.9696728,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.97206706,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"bounds":{"left":0.016954787,"top":0.97047085,"width":0.013630319,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"bounds":{"left":0.016954787,"top":0.9728651,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9728651,"width":0.0023271276,"height":0.009577015}},{"char_start":1,"char_count":7,"bounds":{"left":0.019281914,"top":0.9728651,"width":0.011635638,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"bounds":{"left":0.0016622341,"top":0.9848364,"width":0.054853722,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.0039893617,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"bounds":{"left":0.00831117,"top":0.98723066,"width":0.046210106,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.008643617,"top":0.98723066,"width":0.0009973404,"height":0.009577015}},{"char_start":1,"char_count":25,"bounds":{"left":0.009640957,"top":0.98723066,"width":0.043218084,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"bounds":{"left":0.05718085,"top":0.9848364,"width":0.018949468,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.05851064,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.0631649,"top":0.98723066,"width":0.0039893617,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.06715426,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.071476065,"top":0.98723066,"width":0.0033244682,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"bounds":{"left":0.0774601,"top":0.9848364,"width":0.010638298,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.07912234,"top":0.98643255,"width":0.0043218085,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"bounds":{"left":0.08344415,"top":0.98723066,"width":0.0029920214,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"bounds":{"left":0.99102396,"top":0.9848364,"width":0.008976042,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"bounds":{"left":0.9694149,"top":0.9848364,"width":0.020944148,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"bounds":{"left":0.96110374,"top":0.9848364,"width":0.006981383,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"bounds":{"left":0.9468085,"top":0.9848364,"width":0.012965426,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"bounds":{"left":0.9268617,"top":0.9848364,"width":0.018284574,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"bounds":{"left":0.90325797,"top":0.9848364,"width":0.021941489,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"bounds":{"left":0.8580452,"top":0.9848364,"width":0.04454787,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"bounds":{"left":0.76163566,"top":0.05347167,"width":0.034574468,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.76163566,"top":0.054269753,"width":0.0023271276,"height":0.0103751}},{"char_start":1,"char_count":19,"bounds":{"left":0.76396275,"top":0.054269753,"width":0.032247342,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23238032,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9840425,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.98603725,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.9886968,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.99035907,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"bounds":{"left":0.80418885,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.84075797,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"bounds":{"left":0.7652925,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76828456,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"bounds":{"left":0.7849069,"top":0.07102953,"width":0.04720745,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.83211434,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"bounds":{"left":0.87765956,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8962766,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23071809,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"bounds":{"left":0.8543883,"top":0.07102953,"width":0.04288564,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"bounds":{"left":0.9012633,"top":0.07102953,"width":0.031914894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"bounds":{"left":0.9338431,"top":0.07102953,"width":0.059175532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.9175532,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"bounds":{"left":0.76961434,"top":0.07102953,"width":0.047539894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.09009308,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"bounds":{"left":0.7869016,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.005984043,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.79886967,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"bounds":{"left":0.8068484,"top":0.07102953,"width":0.013962766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"bounds":{"left":0.82081115,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"bounds":{"left":0.8287899,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"bounds":{"left":0.8507314,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"bounds":{"left":0.87267286,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"bounds":{"left":0.87898934,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"bounds":{"left":0.7805851,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"bounds":{"left":0.78291225,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"bounds":{"left":0.80485374,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.029920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"bounds":{"left":0.79288566,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"bounds":{"left":0.83144945,"top":0.07102953,"width":0.07646277,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9075798,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90890956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.91422874,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.953125,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.9617686,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.9674202,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"bounds":{"left":0.9740692,"top":0.07102953,"width":0.011968086,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23138298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"bounds":{"left":0.7898936,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045212764,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.068484046,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.027925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.80086434,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"bounds":{"left":0.81648934,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8380984,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8390958,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.84474736,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.8836436,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.89228725,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"bounds":{"left":0.90425533,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9428192,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19913563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.034242023,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03723404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0787899,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.053856384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.026928192,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.038231384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.041223403,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.078457445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.05285904,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.027260639,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"bounds":{"left":0.8088431,"top":0.07102953,"width":0.08976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"bounds":{"left":0.90525264,"top":0.07102953,"width":0.03856383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.94481385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.032579787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.016954787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"bounds":{"left":0.78956115,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"bounds":{"left":0.82047874,"top":0.07102953,"width":0.025930852,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"bounds":{"left":0.84640956,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"bounds":{"left":0.8680186,"top":0.07102953,"width":0.024933511,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"bounds":{"left":0.7915558,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"bounds":{"left":0.8075133,"top":0.07102953,"width":0.080784574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"bounds":{"left":0.88829786,"top":0.07102953,"width":0.043550532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"bounds":{"left":0.9318484,"top":0.07102953,"width":0.008643617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.09707447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"bounds":{"left":0.78224736,"top":0.07102953,"width":0.04155585,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.07180851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"bounds":{"left":0.84275264,"top":0.07102953,"width":0.036236703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.032912236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"bounds":{"left":0.81150264,"top":0.07102953,"width":0.07081117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"bounds":{"left":0.88231385,"top":0.07102953,"width":0.066821806,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"bounds":{"left":0.80518615,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.023603724,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.017287234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.025598405,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"bounds":{"left":0.8194814,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"bounds":{"left":0.8856383,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"bounds":{"left":0.92486703,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19448139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10571808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.08543883,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09042553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.109042555,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13198139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09674202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10804521,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09275266,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13464096,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13231383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11735372,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1306516,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12765957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.094082445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10006649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12566489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12333777,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07912234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07712766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11868351,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.120678194,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1263298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12034574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.006981383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"bounds":{"left":0.7699468,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.7922208,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"bounds":{"left":0.79421544,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"bounds":{"left":0.81017286,"top":0.07102953,"width":0.06715426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"bounds":{"left":0.87732714,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.93550533,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"bounds":{"left":0.9375,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.22174202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"bounds":{"left":0.7819149,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.84574467,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.84707445,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.8523936,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.004654255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9025931,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90359044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.90924203,"top":0.07102953,"width":0.051861703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sources","depth":21,"bounds":{"left":0.96110374,"top":0.07102953,"width":0.015292553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.97606385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.97706115,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23038563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", they use their own directory (","depth":21,"bounds":{"left":0.80851066,"top":0.07102953,"width":0.054853722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"already inside","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.88796544,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.88896275,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89461434,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"), causing the path to be doubled","depth":21,"bounds":{"left":0.9009308,"top":0.07102953,"width":0.059507977,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9601064,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fix: Use","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"unique variable names in lib","depth":21,"bounds":{"left":0.7775931,"top":0.07102953,"width":0.050531916,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"modules to avoid conflicts:","depth":21,"bounds":{"left":0.8277925,"top":0.07102953,"width":0.04920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.039893616,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9830452,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9850399,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.98836434,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9900266,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.78390956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.7859042,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"bounds":{"left":0.7912234,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"bounds":{"left":0.81515956,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"bounds":{"left":0.8224734,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"bounds":{"left":0.84275264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"bounds":{"left":0.8630319,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"bounds":{"left":0.86835104,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.7765958,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.051529255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"bounds":{"left":0.7859042,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.78956115,"top":0.07102953,"width":0.00731383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"bounds":{"left":0.80984044,"top":0.07102953,"width":0.00731383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"bounds":{"left":0.83710104,"top":0.07102953,"width":0.020611702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"bounds":{"left":0.85738033,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"bounds":{"left":0.8630319,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.7765958,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.051529255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9830452,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9850399,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.98836434,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9900266,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.78390956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.7859042,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"bounds":{"left":0.7912234,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"bounds":{"left":0.81515956,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"bounds":{"left":0.8224734,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"bounds":{"left":0.84275264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"bounds":{"left":0.8630319,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"bounds":{"left":0.86835104,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.7765958,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.051529255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"bounds":{"left":0.7859042,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.78956115,"top":0.07102953,"width":0.00731383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"bounds":{"left":0.80984044,"top":0.07102953,"width":0.00731383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"bounds":{"left":0.83710104,"top":0.07102953,"width":0.020611702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"bounds":{"left":0.85738033,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"bounds":{"left":0.8630319,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.7765958,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.051529255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fixed. The","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issue was that the","depth":21,"bounds":{"left":0.7815825,"top":0.07102953,"width":0.03357713,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib modules were over","depth":21,"bounds":{"left":0.81515956,"top":0.07102953,"width":0.039893616,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"writing the main script's","depth":21,"bounds":{"left":0.8550532,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"bounds":{"left":0.8999335,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable. I renamed it","depth":21,"bounds":{"left":0.91954786,"top":0.07102953,"width":0.03856383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to","depth":21,"bounds":{"left":0.9577792,"top":0.07102953,"width":0.005984043,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":22,"bounds":{"left":0.96476066,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"in both","depth":21,"bounds":{"left":0.9787234,"top":0.07102953,"width":0.013630319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.76861703,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.81416225,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8218085,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8228058,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.8284575,"top":0.07102953,"width":0.051861703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to avoid conflicts.","depth":21,"bounds":{"left":0.8803192,"top":0.07102953,"width":0.032912236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Try running","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script again:","depth":21,"bounds":{"left":0.78357714,"top":0.07102953,"width":0.029920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":23,"bounds":{"left":0.76861703,"top":0.07102953,"width":0.100398935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.21210106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.21941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.21974733,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"db_init_tables() {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.028922873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"run_sqlite_heredoc creating: No such file or directory","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.091755316,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The error shows the","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.035904255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source command is failing and the script is","depth":21,"bounds":{"left":0.79886967,"top":0.07102953,"width":0.077792555,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"trying to execute function definitions as commands. Check","depth":21,"bounds":{"left":0.8763298,"top":0.07102953,"width":0.10605053,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"if the helpers file was copied correctly to","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.2293883,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"your Mac:","depth":21,"bounds":{"left":0.82579786,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cat","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.7726064,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.77460104,"top":0.07102953,"width":0.1043883,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The error shows","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.028922873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.7922208,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.s","depth":22,"bounds":{"left":0.79421544,"top":0.07102953,"width":0.046210106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(missing 'h'), which","depth":21,"bounds":{"left":0.84142286,"top":0.07102953,"width":0.035904255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"suggests a file corruption or incomplete copy. Verify","depth":21,"bounds":{"left":0.87699467,"top":0.07102953,"width":0.0944149,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"all three lib files were","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.2287234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copied intact:","depth":21,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.025598405,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ls","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.0043218085,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.7706117,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-la","depth":23,"bounds":{"left":0.7726064,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~/.screenpipe/scripts/lib/","depth":23,"bounds":{"left":0.7805851,"top":0.07102953,"width":0.052526597,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"If the","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"helpers file is corrupted or empty","depth":21,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.06050532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", copy it again from the NAS.","depth":21,"bounds":{"left":0.8324468,"top":0.07102953,"width":0.051529255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ls -la ~/.screenpipe/scripts/lib/","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.17220744,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07912234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07712766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11635 13 May 11:33 screenpipe_sync_db.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11801862,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4890 13 May 11:34 screenpipe_sync_files.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.120678194,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1263298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ cat ~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.21675532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"#!/bin/bash","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.05119681,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# Helper functions for screenpipe sync scripts","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0774601,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# Source this file in other scripts to use the helpers","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.08577128,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# ─── CONFIG ───────────────────────────────────────────────────────────────────","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# These can be overridden by the sourcing script","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.082446806,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_START=${SCRIPT_START:-$(date +%s)}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.08211436,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"DB_SRC=\"${DB_SRC:-$HOME/.screenpipe/db.sqlite}\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09075798,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LOG_FILE=\"${LOG_FILE:-$HOME/.screenpipe/sync.log}\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09507979,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# ──────────────────────────────────────────────────────────────────────────────","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# ─── HELPERS ──────────────────────────────────────────────────────────────────","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"log() {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local msg=\"[$(date '+%Y-%m-%d %H:%M:%S')] $*\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09075798,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"echo \"$msg\" | tee -a \"$LOG_FILE\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.06017287,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"step() {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.012632979,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local now=$(date +%s)","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.04089096,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local elapsed=$(( now - SCRIPT_START ))","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.072140954,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local min=$(( elapsed / 60 ))","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.049534574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local sec=$(( elapsed % 60 ))","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.051529255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"printf \"\\n[+%02dm%02ds] ▶ %s\\n\" \"$min\" \"$sec\" \"$*\" | tee -a \"$LOG_FILE\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13098404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"run_sqlite_heredoc() {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local label=\"$1\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.02825798,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local sql=\"$2\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.025930852,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local start=$(date +%s)","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.041888297,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.006981383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"helpers file looks correct. The error suggests the","depth":21,"bounds":{"left":0.7699468,"top":0.07102953,"width":0.08843085,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8580452,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":22,"bounds":{"left":0.86037236,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"command is failing silently. Test if","depth":21,"bounds":{"left":0.87234044,"top":0.07102953,"width":0.061170213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the source command works directly:","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.22074468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.0043218085,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.7706117,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~/.screenpipe/scripts/lib","depth":23,"bounds":{"left":0.7726064,"top":0.07102953,"width":0.050199468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"}]...
|
-7944030912499097942
|
7459799153094094059
|
visual_change
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash
cat
~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
The error shows
screenpipe_sync_helpers.s
(missing 'h'), which
suggests a file corruption or incomplete copy. Verify
all three lib files were
copied intact:
bash
ls
-la
~/.screenpipe/scripts/lib/
If the
helpers file is corrupted or empty
, copy it again from the NAS.
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ls -la ~/.screenpipe/scripts/lib/
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11635 13 May 11:33 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4890 13 May 11:34 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ cat ~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
#!/bin/bash
# screenpipe_sync_helpers.sh
# Helper functions for screenpipe sync scripts
# Source this file in other scripts to use the helpers
# ─── CONFIG ───────────────────────────────────────────────────────────────────
# These can be overridden by the sourcing script
SCRIPT_START=${SCRIPT_START:-$(date +%s)}
DB_SRC="${DB_SRC:-$HOME/.screenpipe/db.sqlite}"
LOG_FILE="${LOG_FILE:-$HOME/.screenpipe/sync.log}"
# ──────────────────────────────────────────────────────────────────────────────
# ─── HELPERS ──────────────────────────────────────────────────────────────────
log() {
local msg="[$(date '+%Y-%m-%d %H:%M:%S')] $*"
echo "$msg" | tee -a "$LOG_FILE"
}
step() {
local now=$(date +%s)
local elapsed=$(( now - SCRIPT_START ))
local min=$(( elapsed / 60 ))
local sec=$(( elapsed % 60 ))
printf "\n[+%02dm%02ds] ▶ %s\n" "$min" "$sec" "$*" | tee -a "$LOG_FILE"
}
run_sqlite_heredoc() {
local label="$1"
local sql="$2"
local start=$(date +%s)
Expand content to scroll
Thought
for 3s
The
helpers file looks correct. The error suggests the
source
command is failing silently. Test if
the source command works directly:
bash
cd
~/.screenpipe/scripts/lib
source...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32455
|
1248
|
15
|
2026-05-13T09:22:45.692813+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664165692_m1.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash
cat
~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
The error shows
screenpipe_sync_helpers.s
(missing 'h'), which
suggests a file corruption or incomplete copy. Verify
all three lib files were
copied intact:
bash
ls...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sources","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", they use their own directory (","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"already inside","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"), causing the path to be doubled","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fix: Use","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"unique variable names in lib","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"modules to avoid conflicts:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$LIB_DIR","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/screenpipe_sync_helpers.sh\"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fixed. The","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issue was that the","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib modules were over","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"writing the main script's","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable. I renamed it","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"LIB_DIR","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"in both","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"to avoid conflicts.","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Try running","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script again:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"db_init_tables() {","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"run_sqlite_heredoc creating: No such file or directory","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The error shows the","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source command is failing and the script is","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"trying to execute function definitions as commands. Check","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"if the helpers file was copied correctly to","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"your Mac:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cat","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The error shows","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.s","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(missing 'h'), which","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"suggests a file corruption or incomplete copy. Verify","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"all three lib files were","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copied intact:","depth":21,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ls","depth":23,"on_screen":true,"role_description":"text"}]...
|
1276548819445968571
|
2850371729118719179
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
screenpipe_sync_files.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/screenpipe_sync_helpers.sh"
LIB_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$LIB_DIR
/screenpipe_sync_helpers.sh"
Thoughts
Fixed. The
issue was that the
lib modules were over
writing the main script's
SCRIPT_DIR
variable. I renamed it
to
LIB_DIR
in both
screenpipe_sync_db.sh
and
screenpipe_sync_files.sh
to avoid conflicts.
Try running
the script again:
bash
~
/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
Feedback submitted
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_db.sh: line 13: /Users/lukas/.screenpipe/scripts/lib/screenpipe_sync_helpers.s
# ─── DB FUNCTIONS ─────────────────────────────────────────────────────────────
db_init_tables() {
run_sqlite_heredoc creating: No such file or directory
Expand content to scroll
Thought
for 2s
The error shows the
source command is failing and the script is
trying to execute function definitions as commands. Check
if the helpers file was copied correctly to
your Mac:
bash
cat
~/.screenpipe/scripts/lib/screenpipe_sync_helpers.sh
The error shows
screenpipe_sync_helpers.s
(missing 'h'), which
suggests a file corruption or incomplete copy. Verify
all three lib files were
copied intact:
bash
ls...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32456
|
1249
|
19
|
2026-05-13T09:22:45.734862+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664165734_m2.jpg...
|
Windsurf
|
screenpipe [SSH: nas] — screenpipe_sync_files.sh
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Explorer (⌥⌘E)","depth":18,"bounds":{"left":0.0,"top":0.047885075,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":true},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.05586592,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Search (⇧⌘F)","depth":18,"bounds":{"left":0.0,"top":0.07581804,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.083798885,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Source Control (⇧⌘G)","depth":18,"bounds":{"left":0.0,"top":0.103751,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.11173184,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Codemaps","depth":18,"bounds":{"left":0.0,"top":0.13168396,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.1396648,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DeepWiki","depth":18,"bounds":{"left":0.0,"top":0.15961692,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Run and Debug","depth":18,"bounds":{"left":0.0,"top":0.18754987,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.19553073,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Remote Explorer","depth":18,"bounds":{"left":0.0,"top":0.21548285,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.22346368,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Extensions (⇧⌘X)","depth":18,"bounds":{"left":0.0,"top":0.2434158,"width":0.011635638,"height":0.02793296},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.0033244682,"top":0.25139666,"width":0.004986702,"height":0.011971269},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer","depth":17,"bounds":{"left":0.01462766,"top":0.047885075,"width":0.013630319,"height":0.023144454},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Explorer","depth":18,"bounds":{"left":0.01462766,"top":0.054269753,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.014960106,"top":0.055067837,"width":0.0019946808,"height":0.008778931}},{"char_start":1,"char_count":7,"bounds":{"left":0.016954787,"top":0.055067837,"width":0.011303191,"height":0.008778931}}],"role_description":"text"},{"role":"AXButton","text":"Explorer Section: screenpipe [SSH: nas]","depth":21,"bounds":{"left":0.011635638,"top":0.07102953,"width":0.0831117,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.0726257,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Explorer Section: screenpipe [SSH: nas]","depth":22,"bounds":{"left":0.016954787,"top":0.07102953,"width":0.035904255,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"screenpipe [SSH: nas]","depth":23,"bounds":{"left":0.016954787,"top":0.07342378,"width":0.035904255,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.07342378,"width":0.0019946808,"height":0.009577015}},{"char_start":1,"char_count":20,"bounds":{"left":0.018949468,"top":0.07342378,"width":0.034242023,"height":0.009577015}}],"role_description":"text"},{"role":"AXStaticText","text":"","depth":27,"bounds":{"left":0.019614361,"top":0.08699122,"width":0.0039893617,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe","depth":27,"bounds":{"left":0.025930852,"top":0.08699122,"width":0.01861702,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.025930852,"top":0.087789305,"width":0.0019946808,"height":0.0103751}},{"char_start":1,"char_count":9,"bounds":{"left":0.027925532,"top":0.087789305,"width":0.016954787,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"!","depth":27,"bounds":{"left":0.08909574,"top":0.087789305,"width":0.0013297872,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Outline Section","depth":21,"bounds":{"left":0.011635638,"top":0.95530725,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.95690346,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Outline","depth":22,"bounds":{"left":0.016954787,"top":0.95530725,"width":0.011635638,"height":0.015163607},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Outline","depth":23,"bounds":{"left":0.016954787,"top":0.9577015,"width":0.011635638,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9584996,"width":0.0026595744,"height":0.009577015}},{"char_start":1,"char_count":6,"bounds":{"left":0.019946808,"top":0.9584996,"width":0.008976064,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"Timeline Section","depth":21,"bounds":{"left":0.011635638,"top":0.9696728,"width":0.0831117,"height":0.015163607},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.011968086,"top":0.97206706,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXHeading","text":"Timeline","depth":22,"bounds":{"left":0.016954787,"top":0.97047085,"width":0.013630319,"height":0.014365523},"on_screen":true,"role_description":"heading"},{"role":"AXStaticText","text":"Timeline","depth":23,"bounds":{"left":0.016954787,"top":0.9728651,"width":0.013630319,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.017287234,"top":0.9728651,"width":0.0023271276,"height":0.009577015}},{"char_start":1,"char_count":7,"bounds":{"left":0.019281914,"top":0.9728651,"width":0.011635638,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"alert Disconnected from SSH: nas","depth":16,"bounds":{"left":0.0016622341,"top":0.9848364,"width":0.054853722,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.0039893617,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Disconnected from SSH: nas","depth":17,"bounds":{"left":0.00831117,"top":0.98723066,"width":0.046210106,"height":0.009577015},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.008643617,"top":0.98723066,"width":0.0009973404,"height":0.009577015}},{"char_start":1,"char_count":25,"bounds":{"left":0.009640957,"top":0.98723066,"width":0.043218084,"height":0.009577015}}],"role_description":"text"},{"role":"AXButton","text":"No Problems","depth":16,"bounds":{"left":0.05718085,"top":0.9848364,"width":0.018949468,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.05851064,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.0631649,"top":0.98723066,"width":0.0039893617,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.06715426,"top":0.98643255,"width":0.004654255,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"0","depth":17,"bounds":{"left":0.071476065,"top":0.98723066,"width":0.0033244682,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Forwarded Ports: 41257, 36613, 33153, 45375","depth":16,"bounds":{"left":0.0774601,"top":0.9848364,"width":0.010638298,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":17,"bounds":{"left":0.07912234,"top":0.98643255,"width":0.0043218085,"height":0.011173184},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"4","depth":17,"bounds":{"left":0.08344415,"top":0.98723066,"width":0.0029920214,"height":0.009577015},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Notifications","depth":16,"bounds":{"left":0.99102396,"top":0.9848364,"width":0.008976042,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Shell Script","depth":16,"bounds":{"left":0.9694149,"top":0.9848364,"width":0.020944148,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"LF","depth":16,"bounds":{"left":0.96110374,"top":0.9848364,"width":0.006981383,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"UTF-8","depth":16,"bounds":{"left":0.9468085,"top":0.9848364,"width":0.012965426,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Spaces: 2","depth":16,"bounds":{"left":0.9268617,"top":0.9848364,"width":0.018284574,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Ln 70, Col 1","depth":16,"bounds":{"left":0.90325797,"top":0.9848364,"width":0.021941489,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Screen Reader Optimized","depth":16,"bounds":{"left":0.8580452,"top":0.9848364,"width":0.04454787,"height":0.014365523},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Info: Setting up SSH Host (details): Starting Windsurf SSH...","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Clear","depth":12,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Refactor Sync Script","depth":20,"bounds":{"left":0.76163566,"top":0.05347167,"width":0.034574468,"height":0.011173184},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.76163566,"top":0.054269753,"width":0.0023271276,"height":0.0103751}},{"char_start":1,"char_count":19,"bounds":{"left":0.76396275,"top":0.054269753,"width":0.032247342,"height":0.0103751}}],"role_description":"text"},{"role":"AXStaticText","text":"16h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"2h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1h","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"3m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"1m","depth":20,"on_screen":false,"role_description":"text"},{"role":"AXButton","text":"Show More","depth":19,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23238032,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9840425,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.98603725,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.9886968,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":23,"bounds":{"left":0.99035907,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"target_date","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$1","depth":24,"bounds":{"left":0.80418885,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.012965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"local","depth":24,"bounds":{"left":0.7692819,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"nas_audio","depth":24,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.796875,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":24,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA","depth":24,"bounds":{"left":0.8005319,"top":0.07102953,"width":0.01662234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":24,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$target_date","depth":24,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/audio\"","depth":24,"bounds":{"left":0.84075797,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/","depth":21,"bounds":{"left":0.7652925,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"7","depth":21,"bounds":{"left":0.76828456,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"tasks","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"done","depth":21,"bounds":{"left":0.78025264,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Thoughts","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.015957447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Done. Audio","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"files will now be copied to","depth":21,"bounds":{"left":0.7849069,"top":0.07102953,"width":0.04720745,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.83211434,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/{date}/audio/","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.04255319,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"instead of","depth":21,"bounds":{"left":0.87765956,"top":0.07102953,"width":0.018949468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8962766,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$NAS_DATA/audio/","depth":22,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":". This keeps audio files organized by date alongside the frame","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23071809,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"data.","depth":21,"bounds":{"left":0.8078458,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"will that all work if I move","depth":25,"bounds":{"left":0.8543883,"top":0.07102953,"width":0.04288564,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"@","depth":27,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0033244682,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":27,"bounds":{"left":0.9012633,"top":0.07102953,"width":0.031914894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and lib folder inside scripts folder?","depth":25,"bounds":{"left":0.9338431,"top":0.07102953,"width":0.059175532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.9175532,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 2s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", it will work as long as you","depth":21,"bounds":{"left":0.76961434,"top":0.07102953,"width":0.047539894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"keep the relative structure intact. The script uses:","depth":21,"bounds":{"left":0.8171542,"top":0.07102953,"width":0.09009308,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":22,"bounds":{"left":0.765625,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bash","depth":22,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":23,"bounds":{"left":0.7869016,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.005984043,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":23,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":23,"bounds":{"left":0.79886967,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":23,"bounds":{"left":0.8068484,"top":0.07102953,"width":0.013962766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":23,"bounds":{"left":0.82081115,"top":0.07102953,"width":0.007978723,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":23,"bounds":{"left":0.8287899,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"[0]}\")\" &&","depth":23,"bounds":{"left":0.8507314,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"pwd","depth":23,"bounds":{"left":0.87267286,"top":0.07102953,"width":0.0063164895,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":")\"","depth":23,"bounds":{"left":0.87898934,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"source","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":23,"bounds":{"left":0.7805851,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"$SCRIPT_DIR","depth":23,"bounds":{"left":0.78291225,"top":0.07102953,"width":0.021941489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/lib/screenpipe_sync_helpers.sh\"","depth":23,"bounds":{"left":0.80485374,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This dynamically","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.029920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"finds the directory of","depth":21,"bounds":{"left":0.79288566,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the script being executed, so moving both","depth":21,"bounds":{"left":0.83144945,"top":0.07102953,"width":0.07646277,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9075798,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90890956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.91422874,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.953125,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.9617686,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.9674202,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"into a","depth":21,"bounds":{"left":0.9740692,"top":0.07102953,"width":0.011968086,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23138298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder will","depth":21,"bounds":{"left":0.77160907,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"work fine.","depth":21,"bounds":{"left":0.7898936,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Structure that will work:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045212764,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── lib/","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.068484046,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"├── screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"└── screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.76662236,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Just","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"copy the entire","depth":21,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.027925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.79853725,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"scripts/","depth":22,"bounds":{"left":0.80086434,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"folder (with","depth":21,"bounds":{"left":0.81648934,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.8380984,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8390958,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync.sh","depth":23,"bounds":{"left":0.84474736,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"and","depth":21,"bounds":{"left":0.8836436,"top":0.07102953,"width":0.008976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.89228725,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"inside it) to your Mac","depth":21,"bounds":{"left":0.90425533,"top":0.07102953,"width":0.038896278,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9428192,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s http://localhost:3030/health | jq \"{status, frame_status, audio_status, last_frame: .last_frame_timestamp, uptime: .pipeline.uptime_secs, fps: .pipeline.capture_fps_actual, frames: .pipeline.frames_captured}\"","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19913563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"{","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"healthy\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.034242023,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03723404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:28:00+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0787899,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7879.209718708,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27426608468981734,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.053856384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2161","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.026928192,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"} also what is degraded I received it as response a while ago {","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"status\": \"degraded\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.038231384,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frame_status\": \"ok\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.03756649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"audio_status\": \"stale\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.041223403,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"last_frame\": \"2026-05-13T11:27:35+03:00\",","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.078457445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"uptime\": 7854.077230416,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.048537236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"fps\": 0.27488907183634176,","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.05285904,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"frames\": 2159","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.027260639,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"}","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 1s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.00930851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yes, that command is still","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"correct. It queries the Screenpipe health endpoint","depth":21,"bounds":{"left":0.8088431,"top":0.07102953,"width":0.08976064,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"at","depth":21,"bounds":{"left":0.89860374,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"localhost:3030/health","depth":22,"bounds":{"left":0.90525264,"top":0.07102953,"width":0.03856383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.94481385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Status meanings:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.032579787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"healthy\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.016954787,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- All systems OK","depth":22,"bounds":{"left":0.78956115,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"(frame_status","depth":22,"bounds":{"left":0.82047874,"top":0.07102953,"width":0.025930852,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\", audio","depth":22,"bounds":{"left":0.84640956,"top":0.07102953,"width":0.021609042,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"_status: \"ok\")","depth":22,"bounds":{"left":0.8680186,"top":0.07102953,"width":0.024933511,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"degraded\"","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"- One or","depth":22,"bounds":{"left":0.7915558,"top":0.07102953,"width":0.016289894,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"more subsystems have issues (your example","depth":22,"bounds":{"left":0.8075133,"top":0.07102953,"width":0.080784574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"shows audio_status: \"st","depth":22,"bounds":{"left":0.88829786,"top":0.07102953,"width":0.043550532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ale\")","depth":22,"bounds":{"left":0.9318484,"top":0.07102953,"width":0.008643617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"What \"degraded\" with \"audio_status: stale\" means:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.09707447,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Frame","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.011303191,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"capture is working fine","depth":22,"bounds":{"left":0.78224736,"top":0.07102953,"width":0.04155585,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Audio capture is not working properly or","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.07180851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"is outdated/delayed","depth":22,"bounds":{"left":0.84275264,"top":0.07102953,"width":0.036236703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"This","depth":22,"bounds":{"left":0.7709442,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"could indicate the","depth":22,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.032912236,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio device disconnected, permission","depth":22,"bounds":{"left":0.81150264,"top":0.07102953,"width":0.07081117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"issues, or the audio pipeline stopped","depth":22,"bounds":{"left":0.88231385,"top":0.07102953,"width":0.066821806,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Other possible statuses:","depth":22,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"frame_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\"","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.010305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"| \"stale\" | \"error","depth":22,"bounds":{"left":0.80518615,"top":0.07102953,"width":0.02925532,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"","depth":22,"bounds":{"left":0.83410907,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"audio_status","depth":23,"bounds":{"left":0.7719415,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":": \"ok\" | \"stale","depth":22,"bounds":{"left":0.79521275,"top":0.07102953,"width":0.023603724,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\" | \"error\"","depth":22,"bounds":{"left":0.8188165,"top":0.07102953,"width":0.017287234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The command","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.025598405,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"format is fine - it","depth":21,"bounds":{"left":0.78889626,"top":0.07102953,"width":0.030917553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"extracts the key metrics","depth":21,"bounds":{"left":0.8194814,"top":0.07102953,"width":0.044215426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you need to","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"monitor Screenpipe's","depth":21,"bounds":{"left":0.8856383,"top":0.07102953,"width":0.039228722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"health.","depth":21,"bounds":{"left":0.92486703,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Feedback submitted","depth":20,"bounds":{"left":0.7742686,"top":0.07102953,"width":0.032247342,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.19448139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.22706117,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10571808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 9468000","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 24 lukas staff 768 13 May 11:25 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.08543883,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwx------+ 96 lukas staff 3072 13 May 09:16 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09042553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10305851,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.109042555,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13198139,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09674202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10804521,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10638298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.09275266,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1349734,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13464096,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13397606,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.13231383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11735372,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1306516,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12765957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12965426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.094082445,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.10006649,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12566489,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12333777,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"total 48","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxrwxrwx 5 lukas staff 160 13 May 10:24 .","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07912234,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.07712766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.11868351,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.120678194,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.1263298,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":25,"bounds":{"left":0.99268615,"top":0.07102953,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $","depth":25,"bounds":{"left":0.7659575,"top":0.07102953,"width":0.12034574,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Expand content to scroll","depth":23,"bounds":{"left":0.87333775,"top":0.07102953,"width":0.012300532,"height":0.0007980846},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Thought","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"for 3s","depth":21,"bounds":{"left":0.77859044,"top":0.07102953,"width":0.009640957,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"The","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.006981383,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"error shows","depth":21,"bounds":{"left":0.7699468,"top":0.07102953,"width":0.022273935,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.7922208,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib/lib/","depth":22,"bounds":{"left":0.79421544,"top":0.07102953,"width":0.014960106,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"doubled in the path. The issue is that","depth":21,"bounds":{"left":0.81017286,"top":0.07102953,"width":0.06715426,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the lib modules define their own","depth":21,"bounds":{"left":0.87732714,"top":0.07102953,"width":0.05817819,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.93550533,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":22,"bounds":{"left":0.9375,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"variable, which overwrites","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.22174202,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the one from the main script. When","depth":21,"bounds":{"left":0.7819149,"top":0.07102953,"width":0.06416223,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.84574467,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.84707445,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.8523936,"top":0.07102953,"width":0.045545213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"or","depth":21,"bounds":{"left":0.89793885,"top":0.07102953,"width":0.004654255,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.9025931,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.90359044,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_files.sh","depth":23,"bounds":{"left":0.90924203,"top":0.07102953,"width":0.051861703,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sources","depth":21,"bounds":{"left":0.96110374,"top":0.07102953,"width":0.015292553,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.97606385,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.97706115,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_helpers.sh","depth":23,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.23038563,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":", they use their own directory (","depth":21,"bounds":{"left":0.80851066,"top":0.07102953,"width":0.054853722,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"already inside","depth":21,"bounds":{"left":0.86336434,"top":0.07102953,"width":0.024601065,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":21,"bounds":{"left":0.88796544,"top":0.07102953,"width":0.0009973404,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.88896275,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lib","depth":23,"bounds":{"left":0.89461434,"top":0.07102953,"width":0.0066489363,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"), causing the path to be doubled","depth":21,"bounds":{"left":0.9009308,"top":0.07102953,"width":0.059507977,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":".","depth":21,"bounds":{"left":0.9601064,"top":0.07102953,"width":0.0013297872,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Fix: Use","depth":21,"bounds":{"left":0.76329786,"top":0.07102953,"width":0.014295213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"unique variable names in lib","depth":21,"bounds":{"left":0.7775931,"top":0.07102953,"width":0.050531916,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"modules to avoid conflicts:","depth":21,"bounds":{"left":0.8277925,"top":0.07102953,"width":0.04920213,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.765625,"top":0.07102953,"width":0.003656915,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"screenpipe_sync_db.sh","depth":23,"bounds":{"left":0.77227396,"top":0.07102953,"width":0.039893616,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"+","depth":23,"bounds":{"left":0.9830452,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9850399,"top":0.07102953,"width":0.0023271276,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"-","depth":23,"bounds":{"left":0.98836434,"top":0.07102953,"width":0.0016622341,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"2","depth":23,"bounds":{"left":0.9900266,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"SCRIPT_DIR","depth":24,"bounds":{"left":0.765625,"top":0.07102953,"width":0.01861702,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"=","depth":24,"bounds":{"left":0.78390956,"top":0.07102953,"width":0.0019946808,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.7859042,"top":0.07102953,"width":0.0056515955,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"cd","depth":24,"bounds":{"left":0.7912234,"top":0.07102953,"width":0.0039893617,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"$(","depth":24,"bounds":{"left":0.79488033,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"dirname","depth":24,"bounds":{"left":0.8021942,"top":0.07102953,"width":0.013297873,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"\"${","depth":24,"bounds":{"left":0.81515956,"top":0.07102953,"width":0.0076462766,"height":0.0007980846},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"BASH_SOURCE","depth":24,"bounds":{"left":0.8224734,"top":0.07102953,"width":0.020279255,"height":0.0007980846},"on_screen":true,"role_description":"text"}]...
|
1620270708032028936
|
3967257839636835531
|
click
|
accessibility
|
NULL
|
Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘ Explorer (⌥⌘E)
Search (⇧⌘F)
Source Control (⇧⌘G)
Codemaps
DeepWiki
Run and Debug
Remote Explorer
Extensions (⇧⌘X)
Explorer
Explorer
Explorer Section: screenpipe [SSH: nas]
Explorer Section: screenpipe [SSH: nas]
screenpipe [SSH: nas]
screenpipe
!
Outline Section
Outline
Outline
Timeline Section
Timeline
Timeline
alert Disconnected from SSH: nas
Disconnected from SSH: nas
No Problems
0
0
Forwarded Ports: 41257, 36613, 33153, 45375
4
Notifications
Shell Script
LF
UTF-8
Spaces: 2
Ln 70, Col 1
Screen Reader Optimized
Info: Setting up SSH Host (details): Starting Windsurf SSH...
Clear
Refactor Sync Script
16h
2h
1h
3m
1m
Show More
Thoughts
screenpipe_sync_files.sh
+
1
-
1
local
target_date
=
"
$1
"
local
nas_audio
=
"
$NAS_DATA
/audio"
local
nas_audio
=
"
$NAS_DATA
/
$target_date
/audio"
Thoughts
7
/
7
tasks
done
Thoughts
Done. Audio
files will now be copied to
$NAS_DATA/{date}/audio/
instead of
$NAS_DATA/audio/
. This keeps audio files organized by date alongside the frame
data.
Feedback submitted
will that all work if I move
@
screenpipe_sync.sh
and lib folder inside scripts folder?
Expand content to scroll
Thought
for 2s
Yes
, it will work as long as you
keep the relative structure intact. The script uses:
bash
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE
[0]}")" &&
pwd
)"
source
"
$SCRIPT_DIR
/lib/screenpipe_sync_helpers.sh"
This dynamically
finds the directory of
the script being executed, so moving both
screenpipe_sync.sh
and
lib
into a
scripts/
folder will
work fine.
Structure that will work:
scripts/
├── screenpipe_sync.sh
└── lib/
├── screenpipe_sync_helpers.sh
├── screenpipe_sync_db.sh
└── screenpipe_sync_files.sh
Just
copy the entire
scripts/
folder (with
screenpipe_sync.sh
and
lib
inside it) to your Mac
.
Feedback submitted
is this still the correct command to get the status lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ curl -s [URL_WITH_CREDENTIALS] ~/.screenpipe $ ~/.screenpipe/scripts/screenpipe_sync.sh 2026-05-11
/Users/lukas/.screenpipe/scripts/screenpipe_sync.sh: line 28: /Users/lukas/.screenpipe/scripts/lib/lib/screenpipe_sync_files.sh: No such file or directory
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ ll
total 9468000
drwxr-xr-x 24 lukas staff 768 13 May 11:25 .
drwx------+ 96 lukas staff 3072 13 May 09:16 ..
-rw-r--r--@ 1 lukas staff 10244 13 May 11:26 .DS_Store
-rw-r--r--@ 1 lukas staff 37 11 May 20:54 .sync_install_id
-rw-r--r-- 1 lukas staff 0 10 May 14:43 clipboard-disabled-after-crash
drwxr-xr-x 3996 lukas staff 127872 13 May 11:31 data
-rw-r--r--@ 1 lukas staff 4844216320 13 May 11:31 db.sqlite
-rw-r--r-- 1 lukas staff 65536 13 May 09:17 db.sqlite-shm
-rw-r--r-- 1 lukas staff 955872 13 May 11:31 db.sqlite-wal
drwxr-xr-x 9 lukas staff 288 10 May 11:39 pipes
-rw-r--r-- 1 lukas staff 28408 6 May 21:02 screenpipe.2026-05-06.0.log
-rw-r--r-- 1 lukas staff 566164 7 May 21:50 screenpipe.2026-05-07.0.log
-rw-r--r-- 1 lukas staff 382102 8 May 22:20 screenpipe.2026-05-08.0.log
-rw-r--r-- 1 lukas staff 167023 9 May 23:04 screenpipe.2026-05-09.0.log
-rw-r--r-- 1 lukas staff 88266 10 May 23:51 screenpipe.2026-05-10.0.log
-rw-r--r-- 1 lukas staff 528943 11 May 22:54 screenpipe.2026-05-11.0.log
-rw-r--r-- 1 lukas staff 294131 12 May 21:46 screenpipe.2026-05-12.0.log
-rw-r--r-- 1 lukas staff 86812 13 May 11:31 screenpipe.2026-05-13.0.log
-rwxr-xr-x 1 lukas staff 18401 12 May 21:28 screenpipe_sync.sh
-rwxr-xr-x@ 1 lukas staff 32005 11 May 20:54 screenpipe_sync.sh-bakk
-rwxr-xr-x@ 1 lukas staff 14994 6 May 20:26 screenpipe_sync.sh.bak
-rwxr-xr-x@ 1 lukas staff 21485 10 May 13:34 screenpipe_sync.sh.bak2
drwxr-xr-x 5 lukas staff 160 13 May 11:26 scripts
-rw-r--r--@ 1 lukas staff 13813 12 May 21:36 sync.log
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe $ cd scripts/lib
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $ ll
total 48
drwxrwxrwx 5 lukas staff 160 13 May 10:24 .
drwxr-xr-x 5 lukas staff 160 13 May 11:26 ..
-rwxrwxrwx 1 lukas staff 11643 13 May 10:24 screenpipe_sync_db.sh
-rwxrwxrwx 1 lukas staff 4896 13 May 11:22 screenpipe_sync_files.sh
-rwxrwxrwx 1 lukas staff 2997 13 May 10:23 screenpipe_sync_helpers.sh
lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/.screenpipe/scripts/lib $
Expand content to scroll
Thought
for 3s
The
error shows
lib/lib/
doubled in the path. The issue is that
the lib modules define their own
SCRIPT_DIR
variable, which overwrites
the one from the main script. When
screenpipe_sync_db.sh
or
screenpipe_sync_files.sh
sources
screenpipe_sync_helpers.sh
, they use their own directory (
already inside
lib
), causing the path to be doubled
.
Fix: Use
unique variable names in lib
modules to avoid conflicts:
screenpipe_sync_db.sh
+
2
-
2
SCRIPT_DIR
=
"$(
cd
"$(
dirname
"${
BASH_SOURCE...
|
32454
|
NULL
|
NULL
|
NULL
|
|
32457
|
1249
|
20
|
2026-05-13T09:22:48.136867+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664168136_m2.jpg...
|
Finder
|
data
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
soundcore AeroClip (input)_2026-05-13_09-21-53.mp4
Today at 12:22
30 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-21-21.mp4
Today at 12:21
17 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-20-28.mp4
Today at 12:20
10 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-19-58.mp4
Today at 12:20
11 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-19-28.mp4
Today at 12:19
13 KB...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"Favourites","depth":6,"bounds":{"left":0.004654255,"top":0.061452515,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"jiminny","depth":6,"bounds":{"left":0.012632979,"top":0.08140463,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"AirDrop","depth":6,"bounds":{"left":0.012632979,"top":0.103751,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Recents","depth":6,"bounds":{"left":0.012632979,"top":0.12609737,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Applications","depth":6,"bounds":{"left":0.012632979,"top":0.14844373,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Documents","depth":6,"bounds":{"left":0.012632979,"top":0.1707901,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Downloads","depth":6,"bounds":{"left":0.012632979,"top":0.19313647,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"lukas","depth":6,"bounds":{"left":0.012632979,"top":0.21548285,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"iCloud","depth":6,"bounds":{"left":0.004654255,"top":0.2434158,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"iCloud Drive","depth":6,"bounds":{"left":0.012632979,"top":0.26336792,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Sync folder","depth":6,"bounds":{"left":0.012632979,"top":0.2857143,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Locations","depth":6,"bounds":{"left":0.004654255,"top":0.31364724,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"DXP4800PLUS-B5F","depth":6,"bounds":{"left":0.012632979,"top":0.33359936,"width":0.043218084,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Eject","depth":6,"bounds":{"left":0.05651596,"top":0.33519554,"width":0.0043218085,"height":0.009577015},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false},{"role":"AXStaticText","text":"Network","depth":6,"bounds":{"left":0.012632979,"top":0.35594574,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Tags","depth":6,"bounds":{"left":0.004654255,"top":0.38387868,"width":0.06216755,"height":0.015163607},"on_screen":true,"automation_id":"xSidebarHeader","role_description":"text"},{"role":"AXStaticText","text":"CRM","depth":6,"bounds":{"left":0.012632979,"top":0.4038308,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Orange","depth":6,"bounds":{"left":0.012632979,"top":0.42617717,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Red","depth":6,"bounds":{"left":0.012632979,"top":0.44852355,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Yellow","depth":6,"bounds":{"left":0.012632979,"top":0.4708699,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Green","depth":6,"bounds":{"left":0.012632979,"top":0.49321628,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Blue","depth":6,"bounds":{"left":0.012632979,"top":0.51556265,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Purple","depth":6,"bounds":{"left":0.012632979,"top":0.53790903,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"All Tags…","depth":6,"bounds":{"left":0.012632979,"top":0.5602554,"width":0.049534574,"height":0.012769354},"on_screen":true,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-21-53.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-21-53.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:22","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"30 KB","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-21-21.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-21-21.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:21","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"17 KB","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-20-28.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-20-28.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"10 KB","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-19-58.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-19-58.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:20","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"11 KB","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"MPEG-4 movie","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXTextField","text":"soundcore AeroClip (input)_2026-05-13_09-19-28.mp4","depth":7,"on_screen":false,"value":"soundcore AeroClip (input)_2026-05-13_09-19-28.mp4","role_description":"text field","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Today at 12:19","depth":7,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"13 KB","depth":7,"on_screen":false,"role_description":"text"}]...
|
3577252585057796201
|
-6846977417381120227
|
visual_change
|
accessibility
|
NULL
|
Favourites
jiminny
AirDrop
Recents
Applications
Do Favourites
jiminny
AirDrop
Recents
Applications
Documents
Downloads
lukas
iCloud
iCloud Drive
Sync folder
Locations
DXP4800PLUS-B5F
Eject
Network
Tags
CRM
Orange
Red
Yellow
Green
Blue
Purple
All Tags…
soundcore AeroClip (input)_2026-05-13_09-21-53.mp4
Today at 12:22
30 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-21-21.mp4
Today at 12:21
17 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-20-28.mp4
Today at 12:20
10 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-19-58.mp4
Today at 12:20
11 KB
MPEG-4 movie
soundcore AeroClip (input)_2026-05-13_09-19-28.mp4
Today at 12:19
13 KB...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32458
|
1249
|
21
|
2026-05-13T09:22:51.155345+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664171155_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-5019126902569055025
|
-5818662994288100722
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your...
|
32457
|
NULL
|
NULL
|
NULL
|
|
32459
|
1249
|
22
|
2026-05-13T09:22:54.195503+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664174195_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Top Bar
Top Bar
Sidebar
Sidebar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.31665558,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"bounds":{"left":0.32330453,"top":0.82202715,"width":0.069980055,"height":0.018355945},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"bounds":{"left":0.31565824,"top":0.8216281,"width":0.0066489363,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.31266624,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.32862368,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.3856383,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.39095744,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.41373006,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.42004654,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.30884308,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.39079124,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.39079124,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"bounds":{"left":0.30302528,"top":0.92098963,"width":0.043218084,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"bounds":{"left":0.30867687,"top":0.95730245,"width":0.053523935,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"bounds":{"left":0.31432846,"top":0.96249,"width":0.042220745,"height":0.015163607},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"bounds":{"left":0.44980052,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":10,"bounds":{"left":0.44980052,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":11,"bounds":{"left":0.44980052,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":10,"bounds":{"left":0.44980052,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":11,"bounds":{"left":0.44980052,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Main Content","depth":10,"bounds":{"left":0.44980052,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Main Content","depth":11,"bounds":{"left":0.44980052,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Collapse sidebar [","depth":9,"bounds":{"left":0.4431516,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Collapse sidebar [","depth":11,"bounds":{"left":0.44830453,"top":0.06344773,"width":0.039727394,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Switch sites or apps","depth":10,"bounds":{"left":0.45511967,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Switch sites or apps","depth":12,"bounds":{"left":0.4602726,"top":0.06344773,"width":0.044215426,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Go to your Jira homepage","depth":9,"bounds":{"left":0.46841756,"top":0.057861134,"width":0.029421542,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
-1417905362309582370
|
-6107034110075651442
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Top Bar
Top Bar
Sidebar
Sidebar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32461
|
1249
|
23
|
2026-05-13T09:22:54.764257+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664174764_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-6699246025587850811
|
-6107033010564547954
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:...
|
32459
|
NULL
|
NULL
|
NULL
|
|
32460
|
1248
|
16
|
2026-05-13T09:22:54.765409+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664174765_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
8007424682576413868
|
-5818662996502693234
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named...
|
32455
|
NULL
|
NULL
|
NULL
|
|
32462
|
1249
|
24
|
2026-05-13T09:22:57.250466+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664177250_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
8336604050733150872
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32464
|
1249
|
25
|
2026-05-13T09:22:59.428511+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664179428_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-7992547578182701781
|
-6107034107995800946
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap...
|
32462
|
NULL
|
NULL
|
NULL
|
|
32463
|
1248
|
17
|
2026-05-13T09:22:59.428537+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664179428_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.485,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.5138889,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.51222223,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"bounds":{"left":0.08993056,"top":0.5822222,"width":0.15729167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"bounds":{"left":0.08993056,"top":0.64,"width":0.23923612,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.72888887,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"bounds":{"left":0.10104167,"top":0.7872222,"width":0.07569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"bounds":{"left":0.08993056,"top":0.8477778,"width":0.13541667,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"bounds":{"left":0.08993056,"top":0.87666667,"width":0.009722223,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.103819445,"top":0.87833333,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"bounds":{"left":0.1545139,"top":0.87666667,"width":0.15763889,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.09409722,"top":0.9072222,"width":0.07013889,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"bounds":{"left":0.16840278,"top":0.90555555,"width":0.025347222,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.96555555,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"bounds":{"left":0.10104167,"top":1.0,"width":0.11076389,"height":-0.023888946},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"bounds":{"left":0.08993056,"top":1.0,"width":0.18020834,"height":-0.0844444},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2309666775531005787
|
-5818662994288100722
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32466
|
1249
|
26
|
2026-05-13T09:23:00.192281+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664180192_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-1219042540166140822
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32465
|
1248
|
18
|
2026-05-13T09:23:00.202971+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664180202_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.485,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.5138889,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.51222223,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"bounds":{"left":0.08993056,"top":0.5822222,"width":0.15729167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"bounds":{"left":0.08993056,"top":0.64,"width":0.23923612,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.72888887,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"bounds":{"left":0.10104167,"top":0.7872222,"width":0.07569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"bounds":{"left":0.08993056,"top":0.8477778,"width":0.13541667,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
8658447221292709397
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update...
|
32463
|
NULL
|
NULL
|
NULL
|
|
32467
|
1248
|
19
|
2026-05-13T09:23:06.350837+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664186350_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.485,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.5138889,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.51222223,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"bounds":{"left":0.08993056,"top":0.5822222,"width":0.15729167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"bounds":{"left":0.08993056,"top":0.64,"width":0.23923612,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.72888887,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"bounds":{"left":0.10104167,"top":0.7872222,"width":0.07569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"bounds":{"left":0.08993056,"top":0.8477778,"width":0.13541667,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"bounds":{"left":0.08993056,"top":0.87666667,"width":0.009722223,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.103819445,"top":0.87833333,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"bounds":{"left":0.1545139,"top":0.87666667,"width":0.15763889,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.09409722,"top":0.9072222,"width":0.07013889,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"bounds":{"left":0.16840278,"top":0.90555555,"width":0.025347222,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.96555555,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
-8552194138929729019
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32468
|
1249
|
27
|
2026-05-13T09:23:06.350886+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664186350_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4223829903259382665
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running...
|
32466
|
NULL
|
NULL
|
NULL
|
|
32469
|
1248
|
20
|
2026-05-13T09:23:08.901709+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664188901_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
9075316888591069369
|
-6116041307250017650
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response...
|
32467
|
NULL
|
NULL
|
NULL
|
|
32470
|
1249
|
28
|
2026-05-13T09:23:08.940626+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664188940_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
2933029628829566811
|
-6107033010564547954
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32471
|
1249
|
29
|
2026-05-13T09:23:09.965822+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664189965_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Top Bar
Top Bar...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.31665558,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"bounds":{"left":0.32330453,"top":0.82202715,"width":0.069980055,"height":0.018355945},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"bounds":{"left":0.31565824,"top":0.8216281,"width":0.0066489363,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.31266624,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.32862368,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.3856383,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.39095744,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.41373006,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.42004654,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.30884308,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.39079124,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.39079124,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"bounds":{"left":0.30302528,"top":0.92098963,"width":0.043218084,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"bounds":{"left":0.30867687,"top":0.95730245,"width":0.053523935,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"bounds":{"left":0.31432846,"top":0.96249,"width":0.042220745,"height":0.015163607},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"bounds":{"left":0.44980052,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":10,"bounds":{"left":0.44980052,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":11,"bounds":{"left":0.44980052,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-5347218576919724602
|
-6107034110075651442
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Top Bar
Top Bar...
|
32470
|
NULL
|
NULL
|
NULL
|
|
32472
|
1249
|
30
|
2026-05-13T09:23:12.975032+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664192975_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-5727650683417828735
|
-6107033010564547954
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32473
|
1248
|
21
|
2026-05-13T09:23:13.015670+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664193015_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.485,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.5138889,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.51222223,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"bounds":{"left":0.08993056,"top":0.5822222,"width":0.15729167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"bounds":{"left":0.08993056,"top":0.64,"width":0.23923612,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.72888887,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"bounds":{"left":0.10104167,"top":0.7872222,"width":0.07569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"bounds":{"left":0.08993056,"top":0.8477778,"width":0.13541667,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"bounds":{"left":0.08993056,"top":0.87666667,"width":0.009722223,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.103819445,"top":0.87833333,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"bounds":{"left":0.1545139,"top":0.87666667,"width":0.15763889,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.09409722,"top":0.9072222,"width":0.07013889,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"bounds":{"left":0.16840278,"top":0.90555555,"width":0.025347222,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.96555555,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"bounds":{"left":0.10104167,"top":1.0,"width":0.11076389,"height":-0.023888946},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"bounds":{"left":0.08993056,"top":1.0,"width":0.18020834,"height":-0.0844444},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
7064670235215990903
|
-5827670193542841714
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32475
|
1249
|
31
|
2026-05-13T09:23:21.435984+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664201435_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-5088481052440186810
|
-6107069294712505714
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version...
|
32472
|
NULL
|
NULL
|
NULL
|
|
32474
|
1248
|
22
|
2026-05-13T09:23:21.443077+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664201443_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
5631946095141901979
|
-5827810933245789554
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen...
|
32473
|
NULL
|
NULL
|
NULL
|
|
32476
|
1249
|
32
|
2026-05-13T09:23:22.633983+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664202633_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
7739008178666226046
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32477
|
1249
|
33
|
2026-05-13T09:23:25.668625+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664205668_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-3165692088689810980
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!...
|
32476
|
NULL
|
NULL
|
NULL
|
|
32478
|
1249
|
34
|
2026-05-13T09:23:27.323594+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664207323_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
-1230179651806573218
|
-6107068194936636786
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32479
|
1249
|
35
|
2026-05-13T09:23:28.424108+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664208424_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
8691745942725473221
|
-6116041309330392434
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)...
|
32478
|
NULL
|
NULL
|
NULL
|
|
32480
|
1249
|
36
|
2026-05-13T09:23:28.982225+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664208982_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
3904694084042773049
|
-5818662996435584354
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32481
|
1249
|
37
|
2026-05-13T09:23:33.331661+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664213331_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
4418418704376269236
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini...
|
32480
|
NULL
|
NULL
|
NULL
|
|
32482
|
1248
|
23
|
2026-05-13T09:23:33.346562+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664213346_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.485,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.5138889,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.51222223,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"bounds":{"left":0.08993056,"top":0.5822222,"width":0.15729167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"bounds":{"left":0.08993056,"top":0.64,"width":0.23923612,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.72888887,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"bounds":{"left":0.10104167,"top":0.7872222,"width":0.07569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"bounds":{"left":0.08993056,"top":0.8477778,"width":0.13541667,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"bounds":{"left":0.08993056,"top":0.87666667,"width":0.009722223,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.103819445,"top":0.87833333,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"bounds":{"left":0.1545139,"top":0.87666667,"width":0.15763889,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.09409722,"top":0.9072222,"width":0.07013889,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"bounds":{"left":0.16840278,"top":0.90555555,"width":0.025347222,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.96555555,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.9533333,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"bounds":{"left":0.10104167,"top":1.0,"width":0.11076389,"height":-0.023888946},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"bounds":{"left":0.08993056,"top":1.0,"width":0.18020834,"height":-0.0844444},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
4083492912746194695
|
-5818662994288100722
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32483
|
1248
|
24
|
2026-05-13T09:23:37.300021+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664217300_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.485,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.5138889,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.51222223,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-3941531764508303825
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:...
|
32482
|
NULL
|
NULL
|
NULL
|
|
32484
|
1249
|
38
|
2026-05-13T09:23:37.307456+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664217307_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4069859284776287253
|
-6116041309330392434
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32485
|
1248
|
25
|
2026-05-13T09:23:38.898884+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664218898_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.485,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.5138889,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.51222223,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"bounds":{"left":0.08993056,"top":0.5822222,"width":0.15729167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"bounds":{"left":0.08993056,"top":0.64,"width":0.23923612,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.72888887,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.71666664,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
-242663458391709810
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32486
|
1249
|
39
|
2026-05-13T09:23:38.898891+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664218898_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-5467089360464514423
|
-6116040209818764658
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml...
|
32484
|
NULL
|
NULL
|
NULL
|
|
32487
|
1248
|
26
|
2026-05-13T09:23:43.068719+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664223068_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.38944444,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.38777778,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44444445,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44666666,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48333332,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
5952305354020806576
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update...
|
32485
|
NULL
|
NULL
|
NULL
|
|
32488
|
1249
|
40
|
2026-05-13T09:23:43.068729+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664223068_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2004413851004118659
|
-6107033010564547954
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32490
|
1249
|
41
|
2026-05-13T09:23:46.067846+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664226067_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4072337551878961865
|
-6107069294712505714
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true...
|
32488
|
NULL
|
NULL
|
NULL
|
|
32489
|
1248
|
27
|
2026-05-13T09:23:46.078267+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664226078_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
734509656920614894
|
-5818662996502693234
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app...
|
NULL
|
NULL
|
NULL
|
NULL
|