|
32491
|
1249
|
42
|
2026-05-13T09:23:47.195720+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664227195_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
5351874938738490327
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32492
|
1248
|
28
|
2026-05-13T09:23:48.421150+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664228421_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"}]...
|
7114559073364671844
|
-5818662996435584354
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used...
|
32489
|
NULL
|
NULL
|
NULL
|
|
32493
|
1249
|
43
|
2026-05-13T09:23:48.435460+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664228435_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
3131976458306689224
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line...
|
32491
|
NULL
|
NULL
|
NULL
|
|
32494
|
1248
|
29
|
2026-05-13T09:23:54.152613+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664234152_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-960084503284264012
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
....
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32495
|
1249
|
44
|
2026-05-13T09:23:54.178026+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664234178_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
5789552821212723853
|
-6107069294712505714
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32496
|
1249
|
45
|
2026-05-13T09:23:56.315232+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664236315_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
8336604050733150872
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response...
|
32495
|
NULL
|
NULL
|
NULL
|
|
32497
|
1249
|
46
|
2026-05-13T09:23:59.361018+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664239361_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
8307997009555807931
|
-5818662994288100722
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32498
|
1249
|
47
|
2026-05-13T09:24:05.419742+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664245419_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.31665558,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"bounds":{"left":0.32330453,"top":0.82202715,"width":0.069980055,"height":0.018355945},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"bounds":{"left":0.31565824,"top":0.8216281,"width":0.0066489363,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.31266624,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.32862368,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.3856383,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.39095744,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.41373006,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.42004654,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false}]...
|
-7259533258934979413
|
-5818803733923939698
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message...
|
32497
|
NULL
|
NULL
|
NULL
|
|
32499
|
1249
|
48
|
2026-05-13T09:24:08.453770+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664248453_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4438563949892525121
|
-5818662996435584370
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
....
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32500
|
1249
|
49
|
2026-05-13T09:24:17.532170+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664257532_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
2346165429886333634
|
-6116041307250541938
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension....
|
32499
|
NULL
|
NULL
|
NULL
|
|
32502
|
1249
|
50
|
2026-05-13T09:24:24.414753+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664264414_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2339241134558951569
|
-6106928557228344634
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32501
|
1248
|
30
|
2026-05-13T09:24:24.421047+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664264421_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-960084503284264012
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
....
|
32494
|
NULL
|
NULL
|
NULL
|
|
32503
|
1249
|
51
|
2026-05-13T09:24:26.653416+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664266653_m2.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
[JY-20421] Update libs - Jira
[JY-20421] Update li [JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
5287129860836837220
|
-5827670193542841714
|
visual_change
|
accessibility
|
NULL
|
[JY-20421] Update libs - Jira
[JY-20421] Update li [JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"...
|
32502
|
NULL
|
NULL
|
NULL
|
|
32504
|
1249
|
52
|
2026-05-13T09:24:29.762035+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664269762_m2.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
[JY-20421] Update libs - Jira
[JY-20421] Update li [JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-937195843731476870
|
-6116040209815094642
|
click
|
accessibility
|
NULL
|
[JY-20421] Update libs - Jira
[JY-20421] Update li [JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32505
|
1248
|
31
|
2026-05-13T09:24:29.789344+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664269789_m1.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
[JY-20421] Update libs - Jira
[JY-20421] Update li [JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
5395643398506958955
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
[JY-20421] Update libs - Jira
[JY-20421] Update li [JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code...
|
32494
|
NULL
|
NULL
|
NULL
|
|
32506
|
1248
|
32
|
2026-05-13T09:24:33.833775+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664273833_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2457307757706760732
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it....
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32507
|
1249
|
53
|
2026-05-13T09:24:33.845960+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664273845_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
9221346479515882517
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini...
|
32504
|
NULL
|
NULL
|
NULL
|
|
32508
|
1248
|
33
|
2026-05-13T09:24:35.410592+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664275410_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4062792350078036248
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic...
|
32506
|
NULL
|
NULL
|
NULL
|
|
32509
|
1249
|
54
|
2026-05-13T09:24:35.450033+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664275450_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
4107980470356145691
|
-6116040209818764658
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32510
|
1249
|
55
|
2026-05-13T09:24:35.992291+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664275992_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-7012614135103313041
|
-5818662996435584370
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash...
|
32509
|
NULL
|
NULL
|
NULL
|
|
32511
|
1249
|
56
|
2026-05-13T09:24:39.008023+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664279008_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
2026810237254722184
|
-5827810933245789554
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32512
|
1249
|
57
|
2026-05-13T09:24:57.182515+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664297182_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.01556265,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.014365523,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.043894652,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.06584198,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08539505,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.12290503,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18355946,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26256984,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27214685,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.27294493,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.273743,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27214685,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.39984038,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40223464,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.44373503,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44573024,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44692737,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.52992815,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5506784,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5802075,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.5814046,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6009577,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.60215485,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6009577,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.64365524,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6424581,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.73423785,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.79569036,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7972865,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8236233,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.86632085,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8651237,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.90782124,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9066241,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9680766,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.9696728,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.032413565,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9972067,"width":0.02244016,"height":0.002793312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.9960096,"width":0.114527926,"height":0.0039904118},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0877893},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
4871448882213288278
|
-5818662994288100722
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code...
|
32511
|
NULL
|
NULL
|
NULL
|
|
32514
|
1249
|
58
|
2026-05-13T09:24:57.803841+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664297803_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
483228392132743703
|
-6107456320393758066
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory....
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32513
|
1248
|
34
|
2026-05-13T09:24:57.816240+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664297816_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2509709226259702056
|
-6107034107928692082
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32515
|
1248
|
35
|
2026-05-13T09:24:58.809974+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664298809_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.12222222,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21111111,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.19888888,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.26944444,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.33,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-8621135352020957288
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of...
|
32513
|
NULL
|
NULL
|
NULL
|
|
32516
|
1249
|
59
|
2026-05-13T09:24:58.818006+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664298818_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-960084503284264012
|
-6116041307250541938
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
....
|
32514
|
NULL
|
NULL
|
NULL
|
|
32517
|
1249
|
60
|
2026-05-13T09:25:00.213723+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664300213_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
Jira
Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.0063164895,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.61931366,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6424581,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
6946742509674956963
|
-6107456320393758066
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
Jira
Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32518
|
1249
|
61
|
2026-05-13T09:25:03.239766+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664303239_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.61931366,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6424581,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-8851947710315689437
|
-5818662996435584370
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic...
|
32517
|
NULL
|
NULL
|
NULL
|
|
32519
|
1249
|
62
|
2026-05-13T09:25:06.279404+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664306279_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.61931366,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6424581,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
611067393706287870
|
-5818662996435584370
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32520
|
1249
|
63
|
2026-05-13T09:25:15.377503+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664315377_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.61931366,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6424581,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
804876919869748330
|
-6107456320393758002
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options...
|
32519
|
NULL
|
NULL
|
NULL
|
|
32522
|
1249
|
64
|
2026-05-13T09:25:16.118890+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664316118_m2.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
jiminny.atlassian.net/browse/JY-20421
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.09177973,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.61931366,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6424581,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
7827095974422880024
|
-6107033010564547954
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32521
|
1248
|
36
|
2026-05-13T09:25:16.119061+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664316119_m1.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
jiminny.atlassian.net/browse/JY-20421
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.08993056,"top":0.0,"width":0.24027778,"height":0.026666667},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.19340278,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.067708336,"height":0.022777777},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.16180556,"top":0.0,"width":0.046875,"height":0.020555556},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.08993056,"top":0.0,"width":0.23923612,"height":0.10944445},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.08993056,"top":0.123333335,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.21222222,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.2,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.2,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"bounds":{"left":0.10104167,"top":0.27055556,"width":0.0875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"bounds":{"left":0.08993056,"top":0.3311111,"width":0.23993056,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.09409722,"top":0.39055556,"width":0.046527777,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"bounds":{"left":0.14479166,"top":0.3888889,"width":0.003125,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"bounds":{"left":0.08993056,"top":0.44555557,"width":0.24027778,"height":0.026666667},"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"bounds":{"left":0.08993056,"top":0.44777778,"width":0.18194444,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"bounds":{"left":0.08993056,"top":0.48444444,"width":0.10069445,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.19479166,"top":0.4861111,"width":0.046875,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"bounds":{"left":0.08993056,"top":0.48444444,"width":0.21979167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"bounds":{"left":0.15486111,"top":0.515,"width":0.029166667,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"bounds":{"left":0.08993056,"top":0.5133333,"width":0.23472223,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"bounds":{"left":0.08993056,"top":0.5833333,"width":0.15729167,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"bounds":{"left":0.08993056,"top":0.64111114,"width":0.23923612,"height":0.051666666},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"bounds":{"left":0.10104167,"top":0.73,"width":0.022569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"bounds":{"left":0.2690972,"top":0.7177778,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"bounds":{"left":0.296875,"top":0.7177778,"width":0.027777778,"height":0.044444446},"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"bounds":{"left":0.10104167,"top":0.78833336,"width":0.07569444,"height":0.020555556},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"bounds":{"left":0.08993056,"top":0.8488889,"width":0.13541667,"height":0.022777777},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
504915572359923591
|
-5818662996435584370
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32523
|
1249
|
65
|
2026-05-13T09:25:18.402619+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664318402_m2.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
jiminny.atlassian.net/browse/JY-20421
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.09177973,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.61931366,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6424581,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-3799528885161415498
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push...
|
32522
|
NULL
|
NULL
|
NULL
|
|
32524
|
1249
|
66
|
2026-05-13T09:25:21.587438+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664321587_m2.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.050531916,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.09177973,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.60814047,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.61931366,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6424581,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-70685520422208862
|
-6115900569694553394
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know....
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32525
|
1248
|
37
|
2026-05-13T09:25:21.593914+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664321593_m1.jpg...
|
Firefox
|
[JY-20421] Update libs - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20421] Update libs - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"[JY-20421] Update libs - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-1807775516390658214
|
-6107034110411728178
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
[J Work item search - Jira
Work item search - Jira
[JY-20421] Update libs - Jira
[JY-20421] Update libs - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat....
|
32521
|
NULL
|
NULL
|
NULL
|
|
32526
|
1249
|
67
|
2026-05-13T09:25:24.438397+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664324438_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
[JY-20773] User Pilot not receiving events on repo [JY-20773] User Pilot not receiving events on report generated - Jira
jiminny.atlassian.net
Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira...
|
[{"role":"AXStaticText","text& [{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.3073471,"top":0.22266561,"width":0.08277926,"height":0.021548284},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"jiminny.atlassian.net","depth":4,"bounds":{"left":0.3073471,"top":0.2442139,"width":0.03507314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
4652575499554536795
|
-4017472745437152634
|
visual_change
|
accessibility
|
NULL
|
[JY-20773] User Pilot not receiving events on repo [JY-20773] User Pilot not receiving events on report generated - Jira
jiminny.atlassian.net
Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira...
|
32524
|
NULL
|
NULL
|
NULL
|
|
32527
|
1249
|
68
|
2026-05-13T09:25:27.432028+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664327432_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
....
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4438563949892525121
|
-5818662996435584370
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
....
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32528
|
1249
|
69
|
2026-05-13T09:25:30.479772+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664330479_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.31665558,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"bounds":{"left":0.32330453,"top":0.82202715,"width":0.069980055,"height":0.018355945},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"bounds":{"left":0.31565824,"top":0.8216281,"width":0.0066489363,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.31266624,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.32862368,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.3856383,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.39095744,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.41373006,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.42004654,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false}]...
|
-7259533258934979413
|
-5818803733923939698
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message...
|
32527
|
NULL
|
NULL
|
NULL
|
|
32529
|
1249
|
70
|
2026-05-13T09:25:33.516461+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664333516_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
6442533489717869144
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32530
|
1249
|
71
|
2026-05-13T09:25:36.552766+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664336552_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-3165692088689810980
|
-5818803731776456050
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!...
|
32529
|
NULL
|
NULL
|
NULL
|
|
32531
|
1249
|
72
|
2026-05-13T09:25:39.609020+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664339609_m2.jpg...
|
Slack
|
Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Slack...
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:15:18 PM
12:15
има vulnerabilities по npm
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
James Graham, Direct Message, 1 of 15 suggestions
Channel...
|
[{"role":"AXPopUpButton","text [{"role":"AXPopUpButton","text":"Switch workspaces… (Jiminny Inc) Has new messages","depth":14,"bounds":{"left":0.5152925,"top":1.0,"width":0.011968086,"height":-0.058260202},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Home","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Home","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DMs","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"DMs","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Activity","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Activity","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Later","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Later","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"More…","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Unreads","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.018284574,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Threads","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.01761968,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Huddles","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.018284574,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Drafts & sent","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.02925532,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":21,"bounds":{"left":0.5980718,"top":1.0,"width":0.0026595744,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Directories","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.024268618,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-x-integration-app","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.043882977,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-inner-team","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.04454787,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ai-chapter","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.022273935,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"alerts","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.012300532,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"backend","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.018284574,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bugs","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.010638298,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"confusion-clinic","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.034574468,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"curiosity_lab","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.027593086,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"engineering","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"general","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-bg","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-tickets","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"product_launches","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"random","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"releases","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sofia-office","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"support","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"thank-yous","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the_people_of_jiminny","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"James Graham","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stoyan Tanev","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Galya Dimitrova","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Steliyan Georgiev","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Petko Kashinski","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Aneliya Angelova","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stefka Stoyanova","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Vasil Vasilev","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Jira Cloud","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Toast","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Messages","depth":17,"bounds":{"left":0.61170214,"top":1.0,"width":0.030917553,"height":-0.09177971},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Messages","depth":19,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Add canvas","depth":18,"bounds":{"left":0.64361703,"top":1.0,"width":0.034242023,"height":-0.09177971},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Add canvas","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":17,"bounds":{"left":0.6788564,"top":1.0,"width":0.020944148,"height":-0.09177971},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":19,"on_screen":true,"role_description":"text"},{"role":"AXPopUpButton","text":"Add and Edit Channel Tabs","depth":17,"bounds":{"left":0.70113033,"top":1.0,"width":0.010638298,"height":-0.09177971},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Canvas","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"List","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXPopUpButton","text":"Jump to date","depth":22,"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:31 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти Ники","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:48 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ти май последно работеше по BE upgrade","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:04 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"имаш ли достъп до vanta","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:27 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"при мен все ме връща на моя профил","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:42 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:45 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"къде точно","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:48 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"например това може ли да отвориш","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:07 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Toggle file","depth":24,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXLink","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":26,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Download Screenshot 2026-05-13 at 11.01.01.png","depth":27,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share file: Screenshot 2026-05-13 at 11.01.01.png","depth":27,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"View canvas details","depth":27,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":27,"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:33 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мен все ме праща на","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:50 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Хм, Джейс дали не може да ти помогне?","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:52 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ще питам James, предполагам че нямам права","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"да мерси","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мда","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:58 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"моля","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 12:13:43 PM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:13 PM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Ники сори, още един въпрос имам","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 12:14:12 PM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:14","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"когато ги правеше ти FE ли оправя","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 12:15:18 PM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:15","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"има vulnerabilities по npm","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXTextArea","text":"","depth":23,"on_screen":true,"value":"","role_description":"text entry area","is_enabled":true,"is_focused":true,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"James Graham, Direct Message, 1 of 15 suggestions","depth":11,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Channel","depth":11,"on_screen":false,"role_description":"text"}]...
|
8600620606237554008
|
-1280968901917505216
|
visual_change
|
hybrid
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:15:18 PM
12:15
има vulnerabilities по npm
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
James Graham, Direct Message, 1 of 15 suggestions
Channel
• jiminny• iCloud Drive992 Svnc tolde0 DXP4800PLUS-B5F A€ Networ!• Orange• Red• Yellow• Bue• Purple• All Tags.e MacBook Pro Microphone input 2026-05-13 06-17-55.mp4• System Audio (output) 2026-05-13 06-17-55.mp4MacBook Pro Microphone (input)_2026-05-13_06-17-25.mp4•system Audio (output 2020-05-13 06-1/-20.mp401 MacBook Pro Micronhone linout) 2026-05-12 06-16-53.mn4D System Audio (output)_2026-05-13_06-16-53.mр4>data01 MacBook Pro Microphone inout 2026-05-12 18-45-26,m04|MacBook Pro Microphone (input)_2026-05-12_18-44-26.mp4• MacBook Pro Microphone (input)_2026-05-12_18-43-26.mр4•Maсboоk Pro Microphone (input 2026-05-12 18-42-26.mp4• MacBook Pro Microphone (input)_ 2026-05-12_18-41-26.mp4D MacBook Pro Microphone(input)_2026-05-12_18-40-56.mp4• MacBook Pro Microphone (input) 2026-05-12_ 18-40-26.mp401 MacBook Pro Micronhone (inout) 2026-05-12 18-39-56.mo4D MacBook Pro Microphone (input)_2026-05-12_18-39-26.mp4• MacBook Pro Microphone (input)_2026-05-12_18-38-56.mр4e Macbook Pro Microphone inout2026-06-12 18-38-26,m040 MacBook Pro Microphone (input) 2026-05-12 18-37-56.mp4MacBook Pro Microphone (input)_2026-05-12_18-37-26.mp4• масьоок Prо мiсroрne (input 2026-05-12 18-36-06.mp401 MacBook Pro Micronhone (inout) 2026-05-12 18-36-26.mn4put) 2026-05-12 18-35-56.mp4nout 2026-05-12 18-24-56.mp4• MacBook Pro Microphone (input) 2026-05-12 18-24-26.mp.01 MacBook Pro Microphone (inout) 2026-05-12 18-23-56.mo4MаBооk PO Merophone (nu) 2026-05-1218-22-26 mрMacBook Pro Microphone (input)_2026-05-12_18-22-56.mp4• MacBook Pro Microphone (input) 2026-05-12_18-22-26.mp4@1 MacRook Pro Micronhone (innut) 2026-05-12 18.21-56.mn4inout 2026-05-12 18-21-26.m04• MacBook Pro Microphone (input) 2026-05-12_18-20-56.mp401 MacBook Pro Micronhone (inout) 2026-05-12 18-20-27 mo4MaBok Po Mcrphone (прul) 2026-05-72-18-18-27.mра@ MacBook Pro Microphone (input) 2026-05-12 18-16-57 mр4el MacRool Dra Micranhano finnutl 2026.06. 12 19, 15, 67 mл/MacBook Pro Microphone@ MacBook Pro Microphone (input) 2026-05-12 18-14-57.mp401 MacBook Pro Micronhone (inout) 2026-05-12 18-12-57 mn4@ MacBook Pro Microphone (input) 2026-05-12 18-11-57 mp4MacBook Pro Microphone (inout) 2026-05-12 18-10-57mo4|• •0* Work item search - JiraWJY-199581 Uparade BE libraries(* Low vulnerabilities identified in paNVD - cve-2026-6722(JY-20773] User Pilot not receivin(• JY-19957 | Remove abanded svmdProject Phoenix - FigmaTyoeError: Leaque Flvsystem File.• New Tal(SRD-68481 Sidekick SMS issue -[JY-19957) Upgrade BE librariesJY-19957 | Remove abanded syme) Hiah vulnerabilities identified in oãMedium vulnerabilities identified inLow vulnerabilities identified in pa— New Taby Google Geminicon 't understandlwhat snoula oe donehe tack is addrecsbt vulneraoilities andthere are some vanShow thinkingIt makes complete sense why you areconfused! You were assianed a task to fix"Backend (BE) vulnerabilities" in vour Laravelapp, but the screenshot you provided isactually flagaina a JavaScript/Node.isvulnerability. not a PHP oneThe image shows an alert for npm-elliptic<= 6.6.1 , which is an npm (Node PackageManager) dependency. In modern Laravelapplications, npm is typically used to managetrontend assets and oulld tools like Vite onLaravel Mix. rather than backend Php code(which uses Comooser).Here is exactly what you need to do to resolvethis issue in your project:© Enter a prompt for Geminilcan mike michkos co daltihld checktYotr orivaev remtinSummarize pageI JIMInNYg For you|@ Recent* StarredI0+ AppsQ Spaces- Jiminny (New)lll Plauorm leamIll Caoture TeamID Enterprise Stability I...ID Processing TeamMil SE KanbanService-Desk= More spaces= Filters1• Soarch work items- ast commented= My tickets= (SRD)|= Dialers & CRM Team > ...« Nefault filterci= My open work items= Reported by me= All work itemc= Open work items= Done work items= Viewed recently= Created recently= Resolved recentlv= Updated recently= View all filters[ Dashboardsd: Onerations( confluanco• SearchIAll work•Ask AIIBasiccreated >= -120d AND status = Done ORDER BY created DESO* JY-20100 Deal test result returns parts of the promot in the actual resultJY-20095 Searching by user which is either host or participant - returns 0 activities|@ JY-20087 Refactor how nudges workIn JY-20084 IFE| Tests"Ъ JY-20083 Unit tests9 JY-20074 Triager flow when the lead is converted on the lead svnc' JY-20069 Revert functionality for "Ongoing Meetings"% JY-20067 Remove /on-demand calls every minute Replace with PusherIn JY-20051 IFE| Handle Droodown Filter without titlel"Ъ JY-20050 [FE) Figure out how the Front-end will handle Markdown Links% JY-20049 Manual QA for ZohoUn.1Y-20048 Manual OA for SalesforcelJY-20046 Switching from type to type from the same templates generates AI filling twice• Jy-20043 Test the auality of the new Assembly model |X* JY-20041 Logging activity to CRM after processing does not trigger CRM filling|9 JY-20032 Test cases for HubspotUn.1Y-20031 Test cases for Salesforcel" JY-20029 Optimize TranscriptionAiSummaryReadyEvent retry÷t JY-20028CRM tillina not workind"Ъ JY-20025 Manual testing9 JY-20022 [FEl Kiosk UI' JY-20021 [FE) Handle selected disabled activity types and smart cleanup on removing groups318 от 318Assianee( Ilian KvuchukovNikolay IvanovNikolay Nikolov•Desis av DamvanovMihail MihaylovLukas KovalikNikolay YankovNikolay YankovNikolav YankovNikolay YankovAneliva AngelovaAneliya Angeloval• Mihail Mihaylov6 Todor StamatovMihail MihaylovAneliva AngelovaAneliya AngelovaNikolay Nikolov• Mihail Minavlovoa Martin Petkov•Desisiav Damvanov(6) Desislav Damvanovsupoort Dally • In Zn 3om+ CreateReporter. Martin PetkovAneliya Angelova(1) Ilian KyuchukovDesislav DamyanovMihail MihaylovAneliva AnaelovaNikolay YankovNIKOlay YankoVNikolav YankovNikolay YankovAneliva Angelova•Aneliya AngelovaMartin PetkovGalva DimitrovalMartin DotkovStefka Stoyanova8 Stefka StoyanovaNikolay Nikolov• Martin PetkovMartin PetkovDesisiav DamvanovA Desislav Damvanov100% S2.• wea 13 May 12-20.34"Ask RovoAppsvShare vClear filtersSave filteriPriority= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Mediumi= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= MediumDONIDONIDONIDONIDONEDONIDONIDONIDONIDONI...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32532
|
1248
|
38
|
2026-05-13T09:25:41.665154+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664341665_m1.jpg...
|
Slack
|
Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Slack...
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:15:18 PM
12:15
има vulnerabilities по npm
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
James Graham, Direct Message, 1 of 15 suggestions
Channel...
|
[{"role":"AXPopUpButton","text [{"role":"AXPopUpButton","text":"Switch workspaces… (Jiminny Inc) Has new messages","depth":14,"bounds":{"left":0.51180553,"top":0.08111111,"width":0.025,"height":0.04},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Home","depth":14,"bounds":{"left":0.50625,"top":0.14,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Home","depth":16,"bounds":{"left":0.5138889,"top":0.19222222,"width":0.020833334,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DMs","depth":14,"bounds":{"left":0.50625,"top":0.21555555,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"DMs","depth":16,"bounds":{"left":0.5159722,"top":0.26777777,"width":0.016666668,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Activity","depth":14,"bounds":{"left":0.50625,"top":0.2911111,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Activity","depth":16,"bounds":{"left":0.51111114,"top":0.34333333,"width":0.027083334,"height":0.015555556},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.51111114,"top":0.34333333,"width":0.0055555557,"height":0.015555556}},{"char_start":1,"char_count":7,"bounds":{"left":0.5159722,"top":0.34333333,"width":0.022222223,"height":0.015555556}}],"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":14,"bounds":{"left":0.50625,"top":0.36666667,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":16,"bounds":{"left":0.51666665,"top":0.4188889,"width":0.015972223,"height":0.015555556},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.51666665,"top":0.4188889,"width":0.004166667,"height":0.015555556}},{"char_start":1,"char_count":4,"bounds":{"left":0.5208333,"top":0.4188889,"width":0.011805556,"height":0.015555556}}],"role_description":"text"},{"role":"AXRadioButton","text":"Later","depth":14,"bounds":{"left":0.50625,"top":0.4422222,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Later","depth":16,"bounds":{"left":0.5152778,"top":0.49444443,"width":0.018055556,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"More…","depth":14,"bounds":{"left":0.50625,"top":0.5177778,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More","depth":16,"bounds":{"left":0.5152778,"top":0.57,"width":0.01875,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Unreads","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.038194444,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Threads","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Huddles","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.038194444,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Drafts & sent","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.06111111,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":21,"bounds":{"left":0.68472224,"top":0.12777779,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Directories","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.050694443,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-x-integration-app","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.09166667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-inner-team","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.093055554,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ai-chapter","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.046527777,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"alerts","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.025694445,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"backend","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.038194444,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bugs","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.022222223,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"confusion-clinic","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.072222225,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"curiosity_lab","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.057638887,"height":0.007777778},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"engineering","depth":23,"bounds":{"left":0.58819443,"top":0.14666666,"width":0.054166667,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"general","depth":23,"bounds":{"left":0.58819443,"top":0.17777778,"width":0.034027778,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-bg","depth":23,"bounds":{"left":0.58819443,"top":0.20888889,"width":0.048611112,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-tickets","depth":23,"bounds":{"left":0.58819443,"top":0.24,"width":0.072916664,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.24,"width":0.00625,"height":0.02}},{"char_start":1,"char_count":15,"bounds":{"left":0.59444445,"top":0.24,"width":0.06666667,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"product_launches","depth":23,"bounds":{"left":0.58819443,"top":0.2711111,"width":0.08055556,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"random","depth":23,"bounds":{"left":0.58819443,"top":0.30222222,"width":0.035416666,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"releases","depth":23,"bounds":{"left":0.58819443,"top":0.33333334,"width":0.036805555,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sofia-office","depth":23,"bounds":{"left":0.58819443,"top":0.36444443,"width":0.05138889,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.36444443,"width":0.0048611113,"height":0.02}},{"char_start":1,"char_count":11,"bounds":{"left":0.59305555,"top":0.36444443,"width":0.045833334,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.58819443,"top":0.39555556,"width":0.036111113,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"thank-yous","depth":23,"bounds":{"left":0.58819443,"top":0.42666668,"width":0.05138889,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the_people_of_jiminny","depth":23,"bounds":{"left":0.58819443,"top":0.45777777,"width":0.094444446,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.45777777,"width":0.004166667,"height":0.02}},{"char_start":1,"char_count":20,"bounds":{"left":0.5923611,"top":0.45777777,"width":0.09861111,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.58819443,"top":0.5311111,"width":0.06736111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"James Graham","depth":23,"bounds":{"left":0.58819443,"top":0.56222224,"width":0.06666667,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stoyan Tanev","depth":23,"bounds":{"left":0.58819443,"top":0.5933333,"width":0.060416665,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Galya Dimitrova","depth":23,"bounds":{"left":0.58819443,"top":0.6244444,"width":0.07361111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Steliyan Georgiev","depth":23,"bounds":{"left":0.58819443,"top":0.65555555,"width":0.07986111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Petko Kashinski","depth":23,"bounds":{"left":0.58819443,"top":0.68666667,"width":0.072222225,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Aneliya Angelova","depth":23,"bounds":{"left":0.58819443,"top":0.7177778,"width":0.07847222,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stefka Stoyanova","depth":23,"bounds":{"left":0.58819443,"top":0.7488889,"width":0.079166666,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Vasil Vasilev","depth":23,"bounds":{"left":0.58819443,"top":0.78,"width":0.055555556,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.78,"width":0.00625,"height":0.02}},{"char_start":1,"char_count":12,"bounds":{"left":0.59444445,"top":0.78,"width":0.048611112,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.58819443,"top":0.8111111,"width":0.061805554,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you","depth":23,"bounds":{"left":0.65555555,"top":0.8111111,"width":0.013194445,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.65555555,"top":0.8111111,"width":0.0048611113,"height":0.02}},{"char_start":1,"char_count":2,"bounds":{"left":0.66041666,"top":0.8111111,"width":0.011805556,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"Jira Cloud","depth":23,"bounds":{"left":0.58819443,"top":0.8844444,"width":0.045833334,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Toast","depth":23,"bounds":{"left":0.58819443,"top":0.91555554,"width":0.024305556,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Messages","depth":17,"bounds":{"left":0.71319443,"top":0.12777779,"width":0.06458333,"height":0.04222222},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Messages","depth":19,"bounds":{"left":0.7326389,"top":0.14,"width":0.039583333,"height":0.017777778},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Add canvas","depth":18,"bounds":{"left":0.7798611,"top":0.12777779,"width":0.07152778,"height":0.04222222},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Add canvas","depth":20,"bounds":{"left":0.79930556,"top":0.14,"width":0.046527777,"height":0.017777778},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":17,"bounds":{"left":0.85347223,"top":0.12777779,"width":0.04375,"height":0.04222222},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":19,"bounds":{"left":0.87291664,"top":0.14,"width":0.01875,"height":0.017777778},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.87291664,"top":0.14,"width":0.0055555557,"height":0.017777778}},{"char_start":1,"char_count":4,"bounds":{"left":0.8784722,"top":0.14,"width":0.013194445,"height":0.017777778}}],"role_description":"text"},{"role":"AXPopUpButton","text":"Add and Edit Channel Tabs","depth":17,"bounds":{"left":0.9,"top":0.12777779,"width":0.022222223,"height":0.04222222},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Canvas","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"List","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXPopUpButton","text":"Jump to date","depth":22,"bounds":{"left":0.8229167,"top":0.17666666,"width":0.05277778,"height":0.031111112},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.06458333,"height":0.0011111111},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.16111112,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:31 AM","depth":23,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59 AM","depth":24,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти Ники","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.06666667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:48 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ти май последно работеше по BE upgrade","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.20208333,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:04 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"имаш ли достъп до vanta","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.12222222,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:27 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"при мен все ме връща на моя профил","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.18125,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.07013889,"height":0.0011111111},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.16111112,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:42 AM","depth":23,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.03888889,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:45 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"къде точно","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.054166667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.06458333,"height":0.0011111111},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.16111112,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:48 AM","depth":23,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"например това може ли да отвориш","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.175,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.23541667,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":25,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.23541667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.07013889,"height":0.018888889},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.16111112,"width":0.0055555557,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:07 AM","depth":23,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":24,"bounds":{"left":0.7465278,"top":0.18333334,"width":0.16041666,"height":0.017777778},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.90625,"top":0.18222222,"width":0.0034722222,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Toggle file","depth":24,"bounds":{"left":0.90902776,"top":0.18111111,"width":0.014583333,"height":0.022222223},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXLink","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":26,"bounds":{"left":0.7465278,"top":0.20888889,"width":0.2361111,"height":0.17222223},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Download Screenshot 2026-05-13 at 11.01.01.png","depth":27,"bounds":{"left":0.8840278,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share file: Screenshot 2026-05-13 at 11.01.01.png","depth":27,"bounds":{"left":0.90625,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"View canvas details","depth":27,"bounds":{"left":0.9284722,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":27,"bounds":{"left":0.95069444,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.39444444,"width":0.06458333,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.39666668,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:33 AM","depth":23,"bounds":{"left":0.81666666,"top":0.4,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.81666666,"top":0.4,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мен все ме праща на","depth":24,"bounds":{"left":0.7465278,"top":0.4211111,"width":0.1,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":24,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.23125,"height":0.044444446},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":25,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.23125,"height":0.044444446},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.00625,"height":0.02}},{"char_start":1,"char_count":54,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.23125,"height":0.044444446}}],"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.5011111,"width":0.07013889,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.50333333,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:50 AM","depth":23,"bounds":{"left":0.8215278,"top":0.50666666,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.8215278,"top":0.50666666,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Хм, Джейс дали не може да ти помогне?","depth":24,"bounds":{"left":0.7465278,"top":0.5277778,"width":0.19791667,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.5588889,"width":0.06458333,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.5611111,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:52 AM","depth":23,"bounds":{"left":0.81666666,"top":0.5644444,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.81666666,"top":0.5644444,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ще питам James, предполагам че нямам права","depth":24,"bounds":{"left":0.7465278,"top":0.58555555,"width":0.22291666,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":24,"bounds":{"left":0.71944445,"top":0.62222224,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"bounds":{"left":0.71944445,"top":0.62222224,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"да мерси","depth":24,"bounds":{"left":0.7465278,"top":0.6188889,"width":0.044444446,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.65,"width":0.07013889,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.6522222,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":23,"bounds":{"left":0.8215278,"top":0.65555555,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.8215278,"top":0.65555555,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мда","depth":24,"bounds":{"left":0.7465278,"top":0.6766667,"width":0.019444445,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:58 AM","depth":24,"bounds":{"left":0.71944445,"top":0.7133333,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"bounds":{"left":0.71944445,"top":0.7133333,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"моля","depth":24,"bounds":{"left":0.7465278,"top":0.71,"width":0.025,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.7411111,"width":0.06458333,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.74333334,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 12:13:43 PM","depth":23,"bounds":{"left":0.81666666,"top":0.74666667,"width":0.036111113,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:13 PM","depth":24,"bounds":{"left":0.81666666,"top":0.74666667,"width":0.036111113,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Ники сори, още един въпрос имам","depth":24,"bounds":{"left":0.7465278,"top":0.7677778,"width":0.16736111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 12:14:12 PM","depth":24,"bounds":{"left":0.71944445,"top":0.80444443,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:14","depth":25,"bounds":{"left":0.71944445,"top":0.80444443,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"когато ги правеше ти FE ли оправя","depth":24,"bounds":{"left":0.7465278,"top":0.8011111,"width":0.16805555,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 12:15:18 PM","depth":24,"bounds":{"left":0.71944445,"top":0.8377778,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:15","depth":25,"bounds":{"left":0.71944445,"top":0.8377778,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"има vulnerabilities по npm","depth":24,"bounds":{"left":0.7465278,"top":0.83444446,"width":0.12222222,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXTextArea","text":"","depth":23,"bounds":{"left":0.71666664,"top":0.88,"width":0.26527777,"height":0.04222222},"on_screen":true,"value":"","role_description":"text entry area","is_enabled":true,"is_focused":true,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"James Graham, Direct Message, 1 of 15 suggestions","depth":11,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Channel","depth":11,"on_screen":false,"role_description":"text"}]...
|
8600620606237554008
|
-1280968901917505216
|
visual_change
|
hybrid
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:15:18 PM
12:15
има vulnerabilities по npm
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
James Graham, Direct Message, 1 of 15 suggestions
Channel
SlackFileEditViewGoHistoryWindowHelpDOCKERDEV (-zsh)9 882rsync MacBook Pro Microphone(input)_2026-05-12_18-22-26.mp4→ NAS / 209Krsync MacBook Pro Microphone (input)_2026-05-12_18-22-56.mp4→ NAS ‹ 214Krsync MacBook Pro Microphone (input)_2026-05-12_18-23-26.mp4→ NAS / 212Krsync MacBook Pro Microphone (input)_2026-05-12_18-23-56.mp4→ NAS / 214Krsync MacBook Pro Microphone (input)_2026-05-12_18-24-26.mp4→ NAS ‹ 200Krsync MacBookPro Microphone (input)_2026-05-12_18-24-56.mp4 → NAS ‹ 217Krsync MacBook Pro Microphone (input)_2026-05-12_18-25-56.mp4→ NAS ‹ 214Krsync MacBook Pro Microphone (input)_2026-05-12_18-26-26.mp4 → NAS ‹ 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-26-56.mp4 → NAS ‹ 207Krsync MacBook Pro Microphone (input)_2026-05-12_18-28-26.mp4 → NAS + 216Krsync MacBook Pro Microphone (input)_2026-05-12_18-28-56.mp4→ NAS / 207Krsync MacBook Pro Microphone (input)_2026-05-12_18-29-56.mp4→ NAS ‹ 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-30-56.mp4 → NAS• 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-31-56.mp4→ NAS / 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-32-26.mp4→ NAS ‹ 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-32-56.mp4→ NAS ‹ 201Krsync MacBook Pro Microphone (input)_2026-05-12_18-33-56.mp4→ NAS ‹ 199Krsync MacBook Pro Microphone (input)_2026-05-12__18-34-56.mp4→ NAS ‹ 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-35-26.mp4 → NAS 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-35-56.mp4 → NAS ‹ 200Krsync MacBook Pro Microphone (input)_2026-05-12_18-36-26.mp4 → NAS ‹ 206Krsync MacBook Pro Microphone (input)_2026-05-12_18-36-56.mp4 → NAS ‹ 205Krsync MacBook Pro Microphone (input)_2026-05-12_18-37-26.mp4 NAS ‹ 201Krsync MacBook Pro Microphone (input)_2026-05-12_18-37-56.mp4→ NAS / 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-38-26.mp4 → NAS ‹ 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-38-56.mp4 → NAS ‹ 200Krsync MacBook Pro Microphone (input)_2026-05-12_18-39-26.mp4→ NAS ‹ 200Krsync MacBook Pro Microphone (input)_2026-05-12_18-39-56.mp4 → NAS ‹ 195Krsync MacBook Pro Microphone (input)_2026-05-12_18-40-26.mp4 → NAS ‹ 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-40-56.mp4 → NAS + 202Krsync MacBook Pro Microphone (input)_2026-05-12_18-41-26.mp4 → NAS + 203Krsync MacBook Pro Microphone (input)_2026-05-12_18-42-26.mp4 → NAS ‹ 209Krsync MacBook Pro Microphone (input)_2026-05-12_18-43-26.mp4 NAS ‹ 207Krsync MacBook Pro Microphone (input)_2026-05-12_18-44-26.mp4 → NAS ‹ 210Krsync MacBook Pro Microphone (input)_2026-05-12_18-45-26.mp4 → NAS + 207Kaudio files total:1113 file(s), 145MAPP (-zsh[+08m26s] • Copying screenpipe logs for 2026-05-12rsync logs + NAS• 1 file(s), 304K2026-05-13 12:20:12][2026-05-13 12:20:12][2026-05-1312:20:12]Archive DB size:763MTotal time:8m26sSynccomplete for 2026-05-12[2026-05-13 12:20:12]lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny~/.screenpipe/scripts/lib $ UHomeDMsActivityFilesLaterMorelthl§ Support Daily - in 2h 35 m100% (C478•Wed 13 May 12:25:41QDescribe what you are looking forNikolay Ivanov6 0• MessagesAdd canvasMINOTay IvaHoy 11.01 MIMiScreenshot 2026-0!Today ~O Files+.01.pngJiminny ...cunoartylau# engineering# general# jiminny-bg# platform-tickets# product_launches# random# releases# sofia-office# support# thank-yous# the_people_of jimi...° Direct messages&o Nikolay Ivanovdo James Graham. Stoyan Tanev. Galya Dimitrova. Steliyan GeorgievPetko KashinskiP. Aneliya Angelovaã. Stefka Stoyanova€. Vasil VasilevE. Lukas Kovalik y…..AppsJira CloudToastLukas Kovalik 11:01 AMмен все ме праща наhttps://app.vanta.com/c/jiminny.com/employee/onboardingNikolay Ivanov 11:01 AMХм, Джейс дали не може да ти помогне?Lukas Kovalik 11:01 AMще питам James, предполагам че нямам правада мерсиNikolay Ivanov 11:01 AMмдаМоЛяLukas Kovalik 12:13 PMНики сори, още един въпрос имамкогато ги правеше ти FE ли оправяима vulnerabilities no npmMessage Nikolay Ivanov...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32533
|
1249
|
73
|
2026-05-13T09:26:00.842440+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664360842_m2.jpg...
|
Slack
|
Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Slack...
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…...
|
[{"role":"AXPopUpButton","text [{"role":"AXPopUpButton","text":"Switch workspaces… (Jiminny Inc) Has new messages","depth":14,"bounds":{"left":0.5152925,"top":1.0,"width":0.011968086,"height":-0.058260202},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Home","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Home","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DMs","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"DMs","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Activity","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Activity","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Later","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Later","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"More…","depth":14,"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More","depth":16,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Unreads","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.018284574,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Threads","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.01761968,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Huddles","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.018284574,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Drafts & sent","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.02925532,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":21,"bounds":{"left":0.5980718,"top":1.0,"width":0.0026595744,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Directories","depth":21,"bounds":{"left":0.5465425,"top":1.0,"width":0.024268618,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-x-integration-app","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.043882977,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-inner-team","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.04454787,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ai-chapter","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.022273935,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"alerts","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.012300532,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"backend","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.018284574,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bugs","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.010638298,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"confusion-clinic","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.034574468,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"curiosity_lab","depth":23,"bounds":{"left":0.5518617,"top":1.0,"width":0.027593086,"height":-0.09177971},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"engineering","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"general","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-bg","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-tickets","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"product_launches","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"random","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"releases","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sofia-office","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"support","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"thank-yous","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the_people_of_jiminny","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"James Graham","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stoyan Tanev","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Galya Dimitrova","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Steliyan Georgiev","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Petko Kashinski","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Aneliya Angelova","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stefka Stoyanova","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Vasil Vasilev","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Jira Cloud","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Toast","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Messages","depth":17,"bounds":{"left":0.61170214,"top":1.0,"width":0.030917553,"height":-0.09177971},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Messages","depth":19,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Add canvas","depth":18,"bounds":{"left":0.64361703,"top":1.0,"width":0.034242023,"height":-0.09177971},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Add canvas","depth":20,"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":17,"bounds":{"left":0.6788564,"top":1.0,"width":0.020944148,"height":-0.09177971},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":19,"on_screen":true,"role_description":"text"},{"role":"AXPopUpButton","text":"Add and Edit Channel Tabs","depth":17,"bounds":{"left":0.70113033,"top":1.0,"width":0.010638298,"height":-0.09177971},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Canvas","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"List","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXPopUpButton","text":"Jump to date","depth":22,"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:31 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти Ники","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:48 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ти май последно работеше по BE upgrade","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:04 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"имаш ли достъп до vanta","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:27 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"при мен все ме връща на моя профил","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:42 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:45 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"къде точно","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:48 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"например това може ли да отвориш","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:07 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Toggle file","depth":24,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXLink","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":26,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Download Screenshot 2026-05-13 at 11.01.01.png","depth":27,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share file: Screenshot 2026-05-13 at 11.01.01.png","depth":27,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"View canvas details","depth":27,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":27,"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:33 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мен все ме праща на","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:50 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Хм, Джейс дали не може да ти помогне?","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:52 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ще питам James, предполагам че нямам права","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"да мерси","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мда","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:58 AM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"моля","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 12:13:43 PM","depth":23,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:13 PM","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Ники сори, още един въпрос имам","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 12:14:12 PM","depth":24,"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:14","depth":25,"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"когато ги правеше ти FE ли оправя","depth":24,"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false}]...
|
-5554547773283320759
|
-1280968901917507264
|
visual_change
|
hybrid
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
• jiminny• iCloud Drive992 Svnc toldel0 DXP4800PLUS-B5FA€ Networ!• Orange• Red• Yellow• Purple|• All Tags.e System Audio (output 2026-05-13 06-18-25.mp4© MacBook Pro Microphone (input) 2026-05-13 06-17-55.mp4System Audio (output)_2026-05-13_06-17-55.mp4• MacBook Pro Microphone (input) 2026-05-13_06-17-25.mp4@1 Svstem Audio (outout) 2026-05-13 06-17-25.mo4• MacBook Pro Microphone (input)_2026-05-13_06-16-53.mp4• System Audio (output)_2026-05-13_06-16-53.mp4data© MacBook Pro Microphone (input) 2026-05-12_18-45-26.mp4• MacBook Pro Microphone (input)_2026-05-12_18-44-26.mр4• Maсboоk Pro Microphone (input 2026-05-12 18-43-26.mp4@l MacRook Pro Micronhone (innut) 2026-05-12 18-12-26.mn/D MacBook Pro Microphone(input)_2026-05-12_18-41-26.mp4• MacBook Pro Microphone (input) 2026-05-12 18-40-56.mp401 MacBook Pro Micronhone inout) 2026-05-12 18-40-26.mo4• MacBook Pro Microphone (input)_2026-05-12_18-39-56.mp4• MacBook Pro Microphone (input)_2026-05-12_18-39-26.mр4e Macbook Pro Microphone inout2026-05-1218-38-56.m040 MacBook Pro Microphone (input) 2026-05-12 18-38-26.mp4MacBook Pro Microphone (input)_2026-05-12_18-37-56.mp4• MacBook Pro Microphone (input) 2026-05-12 18-37-26.mp4a1 MacBook Pro Micronhone (inout) 2026-05-12 18-36-56.mn4phone input 2026-05-12 18-36-26.mp4• MaсBook Pro Microphone (input)_2026-05-12_18-35-56.mp.01 MacBook Pro Microphone (inout) 2026-05-12 18-35-26.mo4© MacBook Pro Microphone (input) 2026-05-12 18-34-56.mp42026-05-12 18-33-56 mo4• масbоок Pro Micropnone inout 2020-00-12 18-32-06.mp4al MacBook Pro Micronhone (innut) 2026-05-12 18-32-26.mo4phone input 2026-05-12 18-31-56.mp4• MacBook Pro Microphone (input)_2026-05-12_18-30-56.mp401 MacBook Pro Microphone (inout) 2026-05-12 18-29-56,mo4© MacBook Pro Microphone (input) 2026-05-12 18-28-56.mp4Microphone (input)_2026-05-12_18-28-26.mp4• MacBook Pro Microphone (input) 2026-05-12_18-26-56.mp4@ MacBook Pro Micronhone (innut) 2026-05-12 18-26-26.mn4input 2026-05-12 18-25-56.mp4• MacBook Pro Microphone (input) 2026-05-12 18-24-56.mp.01 MacBook Pro Microphone (inout) 2026-05-12 18-24-26.mo4© MacBook Pro Microphone (input) 2026-05-12 18-23-56.mp4• MacBook Pro Microphone (input) 2026-05-12 18-22-56.mp4@1 MacRook Dro Micronhone (innut) 2026-05-12 18.22-26.mn4• MacBook Pro Micronhone(input)_2026-05-12_18-21-56.mp4• MacBook Pro Microphone (input) 2026-05-12 18-21-26.mp<01 MacBook Pro Micronhone (inout) 2026-05-12 18-20-56.mo4MacBook Pro Microphone (input)_2026-05-12_18-20-27.mp401 MacBook Pro Microphone (inout) 2026-05-12 18-19-27,mo41el MacRool Dra Micranhano finnutl 2026.06. 12 19, 16, 57 mл/MacBook Pro Microphone@ MacBook Pro Microphone (input) 2026-05-12 18-15-27.mp4a1 MacBook Pro Micronhone (inout) 2026-05-12 18-14-57 mo4@ MacBook Pro Microphone (input) 2026-05-12 18-12-57 mр4MacBook Pro Microphone (inout) 2026-05-12 18-11-27mo4* Work item search - JiraWJY-199581 Uparade BE libraries(* Low vulnerabilities identified in pa3 NVD - cve-2026-6722(JY-20773] User Pilot not receivin(• JY-19957 | Remove abanded svmdProject Phoenix - FigmaTyoeError: Leaque Flvsystem File.• New Tal(SRD-68481 Sidekick SMS issue -(JY-19957) Upgrade BE librariesJY-19957 | Remove abanded syme) Hiah vulnerabilities identified in oãMedium vulnerabilities identified inLow vulnerabilities identified in pa— New Tabinny.atlassian.net/issues?jql=created >%3D -120d AND status %3D Done ORDER BY created DESOy Google Geminicon 't understandlwhat snoula oe donehe tack is addrecsbt vulneraoilities andthere are some vanShow thinkingIt makes complete sense why you areconfused! You were assianed a task to fix"Backend (BE) vulnerabilities" in vour Laravelapp, but the screenshot you provided isactually flagaina a JavaScript/Node.isvulnerability. not a PHP oneThe image shows an alert for npm-elliptic<= 6.6.1 , which is an npm (Node PackageManager) dependency. In modern Laravelapplications, npm is typically used to managetrontend assets and oulld tools llke Vite onLaravel Mix, rather than backend Php code(which uses Comooser).Here is exactly what you need to do to resolvethis issue in your project:© Enter a prompt for GeminiI JIMInNY• Search|g For you|All work@ Recent* StarredI•Ask AII0+ AppsQ SpacesJiminny (New)lll Plauorm leamIll Caoture TeamID Enterprise Stability I...ID Processing TeamMil SE KanbanService-Desk= More spaces= Filters1• Soarch work items— ast commented= My tickets= (SRD)|= Dialers & CRM Team > ...« Nefault filterci= My open work items= Reported by me= All work items= Open work items= Done work items= Viewed recently= Created recently= Resolved recentlv= Updated recently= View all filtersllcan mike michkos co dalthld checktYotr orivaev remtin[ Dashboardsd: OnerationsSummarize page( confluancoBasiccreated >= -120d AND status = Done ORDER BY created DESOWork• Jt zuzsI Manual tesunalW PD-187Adontion imnrovements* JY-20250 Execute ES re-mappina first in a separate pr on prodIn JY-20248 |FE| Tests"6 JY-20247 Integration testing9 JY-20246|Swaaaer→ JY-20245 Create activityid → elastic endpoint% JY-20244 Create chart endpointIh.lY-20243 |FF| Tnvert chart quide lines"ь JY-20242 (FE) ChartG JY-20241 [FEl use API endoointU.1Y-202401Test vocabulary handling and custom word accuracy% JY-20239 [FEltabs9 JY-20238 [FE1l local filters* JY-20237 Integrate the new Assembly model into production transcription pipeline9 JY-20236 [FEl update chart tooltip desianQ JY-20235 Integration testing" JY-20234 Remove from databaseQ JY-20233 [FF1 uodate users list desianC.1V.20272 Domovo from Dronhotl9 JY-20231 Remove from Prophet requestUh JY-20230 Remove from htto reauest318 of 3189kellsupoont Dally • In Zn 3om+ CreateAssianeewey varun pelkovAnton Georgiev• Mihail Mihaylov() Desislav Damvanov* Unassigned• Minail MinavlovMihail MihaylovMihail Mihavlov(A) Desislav DamvanovDesislav Damyanov( Desislav DamvanoyMihail Mihaylov(• Desislav Damvanov• Desislav DamvanovMihail Mihaylov• Desislav DamvanovMihail MihaylovMihail Mihaylov() Desislav DamvanovMihail MihaylovMihail MihavlovMihail Mihavlovway мarun relovGalya DimitrovaMinall MinaylovDesislav DamvanovMihail Mihaylov6 Mihail MihaylovMihail MihaylovMihail MihaylovDesislav Damyanov• Desislav Damyanov• Desislav Damvanov68g Todor Stamatov• Desislav DamvanovDesislay Damvanov8y Todor StamatovDesislav Damvanov• Mihail Mihavlov8 Mihail MihaylovDesislav DamvanovMihail MihaylovMihail MihavlovMihail MihavlovA Nociclou Namvano100% S2.• wea 13 May 12-20.00"Ask RovoAppsvShareClear filtersSave filteriPriority- Meaiumi= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Medium= Mediumi= Medium= Medium= MediumDONIDONIDONIDONIDONIDONDONEDONIDONI...
|
32531
|
NULL
|
NULL
|
NULL
|
|
32534
|
1248
|
39
|
2026-05-13T09:26:12.264909+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664372264_m1.jpg...
|
Slack
|
Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Nikolay Ivanov (DM) - Jiminny Inc - 4 new items - Slack...
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:15:18 PM
12:15
има vulnerabilities по npm
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
James Graham, Direct Message, 1 of 15 suggestions
Channel...
|
[{"role":"AXPopUpButton","text [{"role":"AXPopUpButton","text":"Switch workspaces… (Jiminny Inc) Has new messages","depth":14,"bounds":{"left":0.51180553,"top":0.08111111,"width":0.025,"height":0.04},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXRadioButton","text":"Home","depth":14,"bounds":{"left":0.50625,"top":0.14,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Home","depth":16,"bounds":{"left":0.5138889,"top":0.19222222,"width":0.020833334,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"DMs","depth":14,"bounds":{"left":0.50625,"top":0.21555555,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"DMs","depth":16,"bounds":{"left":0.5159722,"top":0.26777777,"width":0.016666668,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Activity","depth":14,"bounds":{"left":0.50625,"top":0.2911111,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Activity","depth":16,"bounds":{"left":0.51111114,"top":0.34333333,"width":0.027083334,"height":0.015555556},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.51111114,"top":0.34333333,"width":0.0055555557,"height":0.015555556}},{"char_start":1,"char_count":7,"bounds":{"left":0.5159722,"top":0.34333333,"width":0.022222223,"height":0.015555556}}],"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":14,"bounds":{"left":0.50625,"top":0.36666667,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":16,"bounds":{"left":0.51666665,"top":0.4188889,"width":0.015972223,"height":0.015555556},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.51666665,"top":0.4188889,"width":0.004166667,"height":0.015555556}},{"char_start":1,"char_count":4,"bounds":{"left":0.5208333,"top":0.4188889,"width":0.011805556,"height":0.015555556}}],"role_description":"text"},{"role":"AXRadioButton","text":"Later","depth":14,"bounds":{"left":0.50625,"top":0.4422222,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Later","depth":16,"bounds":{"left":0.5152778,"top":0.49444443,"width":0.018055556,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"More…","depth":14,"bounds":{"left":0.50625,"top":0.5177778,"width":0.036111113,"height":0.075555556},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"More","depth":16,"bounds":{"left":0.5152778,"top":0.57,"width":0.01875,"height":0.015555556},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Unreads","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.038194444,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Threads","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Huddles","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.038194444,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Drafts & sent","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.06111111,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"1","depth":21,"bounds":{"left":0.68472224,"top":0.12777779,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Directories","depth":21,"bounds":{"left":0.57708335,"top":0.12777779,"width":0.050694443,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-x-integration-app","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.09166667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-inner-team","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.093055554,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ai-chapter","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.046527777,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"alerts","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.025694445,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"backend","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.038194444,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"bugs","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.022222223,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"confusion-clinic","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.072222225,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"curiosity_lab","depth":23,"bounds":{"left":0.58819443,"top":0.12777779,"width":0.057638887,"height":0.007777778},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"engineering","depth":23,"bounds":{"left":0.58819443,"top":0.14666666,"width":0.054166667,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"general","depth":23,"bounds":{"left":0.58819443,"top":0.17777778,"width":0.034027778,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"jiminny-bg","depth":23,"bounds":{"left":0.58819443,"top":0.20888889,"width":0.048611112,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"platform-tickets","depth":23,"bounds":{"left":0.58819443,"top":0.24,"width":0.072916664,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.24,"width":0.00625,"height":0.02}},{"char_start":1,"char_count":15,"bounds":{"left":0.59444445,"top":0.24,"width":0.06666667,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"product_launches","depth":23,"bounds":{"left":0.58819443,"top":0.2711111,"width":0.08055556,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"random","depth":23,"bounds":{"left":0.58819443,"top":0.30222222,"width":0.035416666,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"releases","depth":23,"bounds":{"left":0.58819443,"top":0.33333334,"width":0.036805555,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"sofia-office","depth":23,"bounds":{"left":0.58819443,"top":0.36444443,"width":0.05138889,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.36444443,"width":0.0048611113,"height":0.02}},{"char_start":1,"char_count":11,"bounds":{"left":0.59305555,"top":0.36444443,"width":0.045833334,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"support","depth":23,"bounds":{"left":0.58819443,"top":0.39555556,"width":0.036111113,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"thank-yous","depth":23,"bounds":{"left":0.58819443,"top":0.42666668,"width":0.05138889,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"the_people_of_jiminny","depth":23,"bounds":{"left":0.58819443,"top":0.45777777,"width":0.094444446,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.45777777,"width":0.004166667,"height":0.02}},{"char_start":1,"char_count":20,"bounds":{"left":0.5923611,"top":0.45777777,"width":0.09861111,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.58819443,"top":0.5311111,"width":0.06736111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"James Graham","depth":23,"bounds":{"left":0.58819443,"top":0.56222224,"width":0.06666667,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stoyan Tanev","depth":23,"bounds":{"left":0.58819443,"top":0.5933333,"width":0.060416665,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Galya Dimitrova","depth":23,"bounds":{"left":0.58819443,"top":0.6244444,"width":0.07361111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Steliyan Georgiev","depth":23,"bounds":{"left":0.58819443,"top":0.65555555,"width":0.07986111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Petko Kashinski","depth":23,"bounds":{"left":0.58819443,"top":0.68666667,"width":0.072222225,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Aneliya Angelova","depth":23,"bounds":{"left":0.58819443,"top":0.7177778,"width":0.07847222,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Stefka Stoyanova","depth":23,"bounds":{"left":0.58819443,"top":0.7488889,"width":0.079166666,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Vasil Vasilev","depth":23,"bounds":{"left":0.58819443,"top":0.78,"width":0.055555556,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.58819443,"top":0.78,"width":0.00625,"height":0.02}},{"char_start":1,"char_count":12,"bounds":{"left":0.59444445,"top":0.78,"width":0.048611112,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.58819443,"top":0.8111111,"width":0.061805554,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"you","depth":23,"bounds":{"left":0.65555555,"top":0.8111111,"width":0.013194445,"height":0.02},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.65555555,"top":0.8111111,"width":0.0048611113,"height":0.02}},{"char_start":1,"char_count":2,"bounds":{"left":0.66041666,"top":0.8111111,"width":0.011805556,"height":0.02}}],"role_description":"text"},{"role":"AXStaticText","text":"Jira Cloud","depth":23,"bounds":{"left":0.58819443,"top":0.8844444,"width":0.045833334,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Toast","depth":23,"bounds":{"left":0.58819443,"top":0.91555554,"width":0.024305556,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Messages","depth":17,"bounds":{"left":0.71319443,"top":0.12777779,"width":0.06458333,"height":0.04222222},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true,"is_expanded":false},{"role":"AXStaticText","text":"Messages","depth":19,"bounds":{"left":0.7326389,"top":0.14,"width":0.039583333,"height":0.017777778},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Add canvas","depth":18,"bounds":{"left":0.7798611,"top":0.12777779,"width":0.07152778,"height":0.04222222},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Add canvas","depth":20,"bounds":{"left":0.79930556,"top":0.14,"width":0.046527777,"height":0.017777778},"on_screen":true,"role_description":"text"},{"role":"AXRadioButton","text":"Files","depth":17,"bounds":{"left":0.85347223,"top":0.12777779,"width":0.04375,"height":0.04222222},"on_screen":true,"role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Files","depth":19,"bounds":{"left":0.87291664,"top":0.14,"width":0.01875,"height":0.017777778},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.87291664,"top":0.14,"width":0.0055555557,"height":0.017777778}},{"char_start":1,"char_count":4,"bounds":{"left":0.8784722,"top":0.14,"width":0.013194445,"height":0.017777778}}],"role_description":"text"},{"role":"AXPopUpButton","text":"Add and Edit Channel Tabs","depth":17,"bounds":{"left":0.9,"top":0.12777779,"width":0.022222223,"height":0.04222222},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Canvas","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"List","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Folder","depth":17,"on_screen":false,"role_description":"text"},{"role":"AXPopUpButton","text":"Jump to date","depth":22,"bounds":{"left":0.8229167,"top":0.17666666,"width":0.05277778,"height":0.031111112},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.06458333,"height":0.0011111111},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.16111112,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:31 AM","depth":23,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59 AM","depth":24,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти Ники","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.06666667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 10:59:48 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"10:59","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ти май последно работеше по BE upgrade","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.20208333,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:04 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"имаш ли достъп до vanta","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.12222222,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:27 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"при мен все ме връща на моя профил","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.18125,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.07013889,"height":0.0011111111},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.16111112,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:42 AM","depth":23,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"здрасти","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.03888889,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:45 AM","depth":24,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00","depth":25,"bounds":{"left":0.71944445,"top":0.16111112,"width":0.021527778,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"къде точно","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.054166667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.06458333,"height":0.0011111111},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.16111112,"width":0.0055555557,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:00:48 AM","depth":23,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:00 AM","depth":24,"bounds":{"left":0.81666666,"top":0.16111112,"width":0.036805555,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"например това може ли да отвориш","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.175,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":24,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.23541667,"height":0.0011111111},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results","depth":25,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.23541667,"height":0.0011111111},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.16111112,"width":0.07013889,"height":0.018888889},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.16111112,"width":0.0055555557,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:07 AM","depth":23,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.8215278,"top":0.16111112,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":24,"bounds":{"left":0.7465278,"top":0.18333334,"width":0.16041666,"height":0.017777778},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"","depth":24,"bounds":{"left":0.90625,"top":0.18222222,"width":0.0034722222,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXButton","text":"Toggle file","depth":24,"bounds":{"left":0.90902776,"top":0.18111111,"width":0.014583333,"height":0.022222223},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":true},{"role":"AXLink","text":"Screenshot 2026-05-13 at 11.01.01.png","depth":26,"bounds":{"left":0.7465278,"top":0.20888889,"width":0.2361111,"height":0.17222223},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Download Screenshot 2026-05-13 at 11.01.01.png","depth":27,"bounds":{"left":0.8840278,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share file: Screenshot 2026-05-13 at 11.01.01.png","depth":27,"bounds":{"left":0.90625,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"View canvas details","depth":27,"bounds":{"left":0.9284722,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":27,"bounds":{"left":0.95069444,"top":0.22444445,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.39444444,"width":0.06458333,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.39666668,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:33 AM","depth":23,"bounds":{"left":0.81666666,"top":0.4,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.81666666,"top":0.4,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мен все ме праща на","depth":24,"bounds":{"left":0.7465278,"top":0.4211111,"width":0.1,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":24,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.23125,"height":0.044444446},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"https://app.vanta.com/c/jiminny.com/employee/onboarding","depth":25,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.23125,"height":0.044444446},"on_screen":true,"lines":[{"char_start":0,"char_count":1,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.00625,"height":0.02}},{"char_start":1,"char_count":54,"bounds":{"left":0.7465278,"top":0.44555557,"width":0.23125,"height":0.044444446}}],"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.37555555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.5011111,"width":0.07013889,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.50333333,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:50 AM","depth":23,"bounds":{"left":0.8215278,"top":0.50666666,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.8215278,"top":0.50666666,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Хм, Джейс дали не може да ти помогне?","depth":24,"bounds":{"left":0.7465278,"top":0.5277778,"width":0.19791667,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.48222223,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.5588889,"width":0.06458333,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.5611111,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:52 AM","depth":23,"bounds":{"left":0.81666666,"top":0.5644444,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.81666666,"top":0.5644444,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"ще питам James, предполагам че нямам права","depth":24,"bounds":{"left":0.7465278,"top":0.58555555,"width":0.22291666,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.54,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":24,"bounds":{"left":0.71944445,"top":0.62222224,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"bounds":{"left":0.71944445,"top":0.62222224,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"да мерси","depth":24,"bounds":{"left":0.7465278,"top":0.6188889,"width":0.044444446,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.58444446,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Nikolay Ivanov","depth":23,"bounds":{"left":0.7465278,"top":0.65,"width":0.07013889,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8159722,"top":0.6522222,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 11:01:56 AM","depth":23,"bounds":{"left":0.8215278,"top":0.65555555,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01 AM","depth":24,"bounds":{"left":0.8215278,"top":0.65555555,"width":0.036805555,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"мда","depth":24,"bounds":{"left":0.7465278,"top":0.6766667,"width":0.019444445,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.6311111,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 11:01:58 AM","depth":24,"bounds":{"left":0.71944445,"top":0.7133333,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"11:01","depth":25,"bounds":{"left":0.71944445,"top":0.7133333,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"моля","depth":24,"bounds":{"left":0.7465278,"top":0.71,"width":0.025,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.6755555,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Lukas Kovalik","depth":23,"bounds":{"left":0.7465278,"top":0.7411111,"width":0.06458333,"height":0.024444444},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"","depth":23,"bounds":{"left":0.8111111,"top":0.74333334,"width":0.0055555557,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXLink","text":"Today at 12:13:43 PM","depth":23,"bounds":{"left":0.81666666,"top":0.74666667,"width":0.036111113,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:13 PM","depth":24,"bounds":{"left":0.81666666,"top":0.74666667,"width":0.036111113,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"Ники сори, още един въпрос имам","depth":24,"bounds":{"left":0.7465278,"top":0.7677778,"width":0.16736111,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.7222222,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 12:14:12 PM","depth":24,"bounds":{"left":0.71944445,"top":0.80444443,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:14","depth":25,"bounds":{"left":0.71944445,"top":0.80444443,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"когато ги правеше ти FE ли оправя","depth":24,"bounds":{"left":0.7465278,"top":0.8011111,"width":0.16805555,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.76666665,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXLink","text":"Today at 12:15:18 PM","depth":24,"bounds":{"left":0.71944445,"top":0.8377778,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"link","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"12:15","depth":25,"bounds":{"left":0.71944445,"top":0.8377778,"width":0.021527778,"height":0.016666668},"on_screen":true,"role_description":"text"},{"role":"AXStaticText","text":"има vulnerabilities по npm","depth":24,"bounds":{"left":0.7465278,"top":0.83444446,"width":0.12222222,"height":0.02},"on_screen":true,"role_description":"text"},{"role":"AXCheckBox","text":"React with white_check_mark","depth":25,"bounds":{"left":0.8048611,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with eyes","depth":25,"bounds":{"left":0.82708335,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"React with raised_hands","depth":25,"bounds":{"left":0.84930557,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Add reaction…","depth":25,"bounds":{"left":0.8715278,"top":0.8,"width":0.022222223,"height":0.035555556},"on_screen":true,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Reply in thread","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Forward message…","depth":25,"on_screen":false,"role_description":"button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXCheckBox","text":"Save for later","depth":25,"on_screen":false,"role_description":"toggle button","subrole":"AXToggleButton","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXPopUpButton","text":"More actions","depth":25,"on_screen":false,"role_description":"pop-up button","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXTextArea","text":"","depth":23,"bounds":{"left":0.71666664,"top":0.88,"width":0.26527777,"height":0.04222222},"on_screen":true,"value":"","role_description":"text entry area","is_enabled":true,"is_focused":true,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"James Graham, Direct Message, 1 of 15 suggestions","depth":11,"on_screen":false,"role_description":"text"},{"role":"AXStaticText","text":"Channel","depth":11,"on_screen":false,"role_description":"text"}]...
|
8600620606237554008
|
-1280968901917505216
|
idle
|
hybrid
|
NULL
|
Switch workspaces… (Jiminny Inc) Has new messages
Switch workspaces… (Jiminny Inc) Has new messages
Home
Home
DMs
DMs
Activity
Activity
Files
Files
Later
Later
More…
More
Unreads
Threads
Huddles
Drafts & sent
1
Directories
jiminny-x-integration-app
platform-inner-team
ai-chapter
alerts
backend
bugs
confusion-clinic
curiosity_lab
engineering
general
jiminny-bg
platform-tickets
product_launches
random
releases
sofia-office
support
thank-yous
the_people_of_jiminny
Nikolay Ivanov
James Graham
Stoyan Tanev
Galya Dimitrova
Steliyan Georgiev
Petko Kashinski
Aneliya Angelova
Stefka Stoyanova
Vasil Vasilev
Lukas Kovalik
you
Jira Cloud
Toast
Messages
Messages
Add canvas
Add canvas
Files
Files
Add and Edit Channel Tabs
Canvas
List
Folder
Jump to date
Lukas Kovalik
Today at 10:59:31 AM
10:59 AM
здрасти Ники
Today at 10:59:48 AM
10:59
ти май последно работеше по BE upgrade
Today at 11:00:04 AM
11:00
имаш ли достъп до vanta
Today at 11:00:27 AM
11:00
при мен все ме връща на моя профил
Nikolay Ivanov
Today at 11:00:42 AM
11:00 AM
здрасти
Today at 11:00:45 AM
11:00
къде точно
Lukas Kovalik
Today at 11:00:48 AM
11:00 AM
например това може ли да отвориш
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
https://app.vanta.com/c/jiminny.com/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-low?tab=results
Nikolay Ivanov
Today at 11:01:07 AM
11:01 AM
Screenshot 2026-05-13 at 11.01.01.png
Toggle file
Screenshot 2026-05-13 at 11.01.01.png
Download Screenshot 2026-05-13 at 11.01.01.png
Share file: Screenshot 2026-05-13 at 11.01.01.png
View canvas details
More actions
Lukas Kovalik
Today at 11:01:33 AM
11:01 AM
мен все ме праща на
https://app.vanta.com/c/jiminny.com/employee/onboarding
https://app.vanta.com/c/jiminny.com/employee/onboarding
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:50 AM
11:01 AM
Хм, Джейс дали не може да ти помогне?
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 11:01:52 AM
11:01 AM
ще питам James, предполагам че нямам права
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:56 AM
11:01
да мерси
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Nikolay Ivanov
Today at 11:01:56 AM
11:01 AM
мда
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 11:01:58 AM
11:01
моля
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Lukas Kovalik
Today at 12:13:43 PM
12:13 PM
Ники сори, още един въпрос имам
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:14:12 PM
12:14
когато ги правеше ти FE ли оправя
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
Today at 12:15:18 PM
12:15
има vulnerabilities по npm
React with white_check_mark
React with eyes
React with raised_hands
Add reaction…
Reply in thread
Forward message…
Save for later
More actions
James Graham, Direct Message, 1 of 15 suggestions
Channel
SlackFileEditViewGoHistoryWindowHelpDOCKERDEV (-zsh)9 882rsync MacBook Pro Microphone(input)_2026-05-12_18-22-26.mp4→ NAS / 209Krsync MacBook Pro Microphone (input)_2026-05-12_18-22-56.mp4→ NAS ‹ 214Krsync MacBook Pro Microphone (input)_2026-05-12_18-23-26.mp4→ NAS ‹ 212Krsync MacBook Pro Microphone (input)_2026-05-12_18-23-56.mp4→ NAS / 214Krsync MacBook Pro Microphone (input)_2026-05-12_18-24-26.mp4→ NAS ‹ 200Krsync MacBookPro Microphone (input)_2026-05-12_18-24-56.mp4 → NAS ‹ 217Krsync MacBook Pro Microphone (input)_2026-05-12_18-25-56.mp4→ NAS ‹ 214Krsync MacBook Pro Microphone (input)_2026-05-12_18-26-26.mp4→ NAS • 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-26-56.mp4 → NAS ‹ 207Krsync MacBook Pro Microphone (input)_2026-05-12_18-28-26.mp4 → NAS + 216Krsync MacBook Pro Microphone (input)_2026-05-12_18-28-56.mp4→ NAS / 207Krsync MacBook Pro Microphone (input)_2026-05-12_18-29-56.mp4→ NAS ‹ 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-30-56.mp4 → NAS• 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-31-56.mp4→ NAS / 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-32-26.mp4→ NAS /199Krsync MacBook Pro Microphone (input)_2026-05-12_18-32-56.mp4→ NAS ‹ 201Krsync MacBook Pro Microphone (input)_2026-05-12_18-33-56.mp4→ NAS ‹ 199Krsync MacBook Pro Microphone (input)_2026-05-12__18-34-56.mp4→ NAS ‹ 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-35-26.mp4 → NAS 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-35-56.mp4 → NAS ‹ 200Krsync MacBook Pro Microphone (input)_2026-05-12_18-36-26.mp4 → NAS ‹ 206Krsync MacBook Pro Microphone (input)_2026-05-12_18-36-56.mp4 → NAS ‹ 205Krsync MacBook Pro Microphone (input)_2026-05-12_18-37-26.mp4 NAS ‹ 201Krsync MacBook Pro Microphone (input)_2026-05-12_18-37-56.mp4→ NAS / 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-38-26.mp4 → NAS ‹ 199Krsync MacBook Pro Microphone (input)_2026-05-12_18-38-56.mp4 → NAS ‹ 200Krsync MacBook Pro Microphone (input)_2026-05-12_18-39-26.mp4→ NAS ‹ 200Krsync MacBook Pro Microphone (input)_2026-05-12_18-39-56.mp4 → NAS ‹ 195Krsync MacBook Pro Microphone (input)_2026-05-12_18-40-26.mp4 → NAS ‹ 198Krsync MacBook Pro Microphone (input)_2026-05-12_18-40-56.mp4 → NAS + 202Krsync MacBook Pro Microphone (input)_2026-05-12_18-41-26.mp4 → NAS + 203Krsync MacBook Pro Microphone (input)_2026-05-12_18-42-26.mp4 → NAS ‹ 209Krsync MacBook Pro Microphone (input)_2026-05-12_18-43-26.mp4 NAS ‹ 207Krsync MacBook Pro Microphone (input)_2026-05-12_18-44-26.mp4 → NAS ‹ 210Krsync MacBook Pro Microphone (input)_2026-05-12_18-45-26.mp4 → NAS + 207Kaudio files total:1113 file(s), 145M[+08m26s] • Copying screenpipe logs for 2026-05-12rsync logs + NAS• 1 file(s), 304K2026-05-13 12:20:12][2026-05-13 12:20:12][2026-05-1312:20:12]Archive DB size:763MTotal time:8m26sSynccomplete for 2026-05-12[2026-05-13 12:20:12]lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny~/.screenpipe/scripts/lib $ UAPP (-zshHomeDMsActivityFilesLaterMorelhlSupport Daily - in 2 h 34 m100% (C48•Wed 13 May 12:26:11QDescribe what you are looking forNikolay Ivanov6 0• MessagesAdd canvasMINOTay IVaHoy 11.01 MIMiScreenshot 2026-0!Today ~O Files+.01.png-Jiminny ...cunoartylau# engineering# general# jiminny-bg# platform-tickets# product_launches# random# releases# sofia-office# support# thank-yous# the_people_of jimi...° Direct messages&o Nikolay Ivanovdo James Graham. Stoyan Tanev. Galya DimitrovaRo Steliyan GeorgievLo Petko KashinskiR. Aneliya Angelovaã. Stefka Stoyanova€. Vasil VasilevE. Lukas Kovalik y…..AppsJira CloudToastLukas Kovalik 11:01 AMмен все ме праща наhttps://app.vanta.com/c/jiminny.com/employee/onboardingNikolay Ivanov 11:01 AMХм, Джейс дали не може да ти помогне?Lukas Kovalik 11:01 AMще питам James, предполагам че нямам правада мерсиNikolay Ivanov 11:01 AMмдаМоЛяLukas Kovalik 12:13 PMНики сори, още един въпрос имамкогато ги правеше ти FE ли оправяима vulnerabilities no npmMessage Nikolay Ivanov...
|
32532
|
NULL
|
NULL
|
NULL
|
|
32535
|
1248
|
40
|
2026-05-13T09:26:21.854959+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664381854_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-3344514750528807801
|
-6107456320393758002
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:...
|
32532
|
NULL
|
NULL
|
NULL
|
|
32536
|
1249
|
74
|
2026-05-13T09:26:21.854977+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664381854_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-3843758359520110840
|
-6115900569694553394
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32538
|
1249
|
75
|
2026-05-13T09:26:23.124692+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664383124_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false}]...
|
5783465067874548578
|
-6107069294779614578
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code...
|
32536
|
NULL
|
NULL
|
NULL
|
|
32537
|
1248
|
41
|
2026-05-13T09:26:23.124711+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664383124_m1.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_1
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.0,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.0013888889,"top":0.0,"width":0.022222223,"height":0.035555556},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-2863494379453209520
|
-6107034107928167794
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32539
|
1249
|
76
|
2026-05-13T09:26:28.633730+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664388633_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Top Bar
Top Bar
Sidebar
Sidebar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Search, press enter to navigate to advanced search with your text query
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", your application has access to the vulnerable extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Check Your PHP Version","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Check Your PHP Version","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In the CLI:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -v","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In your Laravel App:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-php'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(phpversion());\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. How to Secure Your Environment","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. How to Secure Your Environment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: Update PHP (Recommended)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Sail / Docker:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Modify the PHP version referenced in your","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"docker-compose.yml","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or Dockerfile, then rebuild your containers using","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sail build --no-cache","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel Forge / Vapor:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Ubuntu / Debian Server:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run standard package manager updates (e.g.,","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo apt-get update && sudo apt-get upgrade php8.x-soap","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Disable the SOAP Extension (Workaround)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Find your loaded","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file by running","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php --ini","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Open the file and locate the line","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.078457445,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=soap","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.0390625,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(or","depth":26,"bounds":{"left":0.36901596,"top":0.0,"width":0.009807181,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension=php_soap.dll","depth":27,"bounds":{"left":0.32795876,"top":0.0,"width":0.061502658,"height":0.014764565},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"on Windows).","depth":26,"bounds":{"left":0.39145613,"top":0.0,"width":0.033410903,"height":0.016360734},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Comment it out by adding a semicolon to the start of the line:","depth":26,"bounds":{"left":0.3259641,"top":0.0,"width":0.10023271,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":";extension=soap","depth":27,"bounds":{"left":0.37699467,"top":0.016360734,"width":0.041888297,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"bounds":{"left":0.42087767,"top":0.015163607,"width":0.0013297872,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Restart your web server or PHP-FPM service (e.g.,","depth":26,"bounds":{"left":0.3259641,"top":0.044692736,"width":0.09009308,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sudo systemctl restart php8.2-fpm","depth":27,"bounds":{"left":0.3259641,"top":0.066640064,"width":0.09857048,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":26,"bounds":{"left":0.3558843,"top":0.08619314,"width":0.0033244682,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"bounds":{"left":0.31000665,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"bounds":{"left":0.32064494,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"bounds":{"left":0.33128324,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"bounds":{"left":0.34192154,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"bounds":{"left":0.35255983,"top":0.123703115,"width":0.010638298,"height":0.025538707},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show the uploaded image in a lightbox","depth":21,"bounds":{"left":0.34258643,"top":0.18435754,"width":0.08843085,"height":0.0726257},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"bounds":{"left":0.3259641,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Edit","depth":21,"bounds":{"left":0.34059176,"top":0.26336792,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":21,"bounds":{"left":0.36053857,"top":0.27294493,"width":0.051861703,"height":0.09577015},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"bounds":{"left":0.30302528,"top":0.273743,"width":0.019946808,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise","depth":23,"bounds":{"left":0.36053857,"top":0.2745411,"width":0.051861703,"height":0.13128492},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"bounds":{"left":0.41240028,"top":0.27294493,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"bounds":{"left":0.41771942,"top":0.40063846,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"bounds":{"left":0.32662898,"top":0.40303272,"width":0.030917553,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"bounds":{"left":0.32430187,"top":0.4445331,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"bounds":{"left":0.32430187,"top":0.44652835,"width":0.04105718,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"It makes complete sense why you are confused! You were assigned a task to fix \"Backend (BE) vulnerabilities\" in your Laravel app, but the screenshot you provided is actually flagging a","depth":24,"bounds":{"left":0.31333113,"top":0.44772545,"width":0.10954122,"height":0.09936153},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JavaScript/Node.js vulnerability","depth":24,"bounds":{"left":0.31333113,"top":0.53072625,"width":0.09624335,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", not a PHP one.","depth":24,"bounds":{"left":0.3460771,"top":0.5514765,"width":0.038397606,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The image shows an alert for","depth":24,"bounds":{"left":0.31333113,"top":0.5810056,"width":0.07114362,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm-elliptic <= 6.6.1","depth":25,"bounds":{"left":0.31333113,"top":0.58220273,"width":0.109375,"height":0.035514764},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", which is an","depth":24,"bounds":{"left":0.33759972,"top":0.6017558,"width":0.030751329,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.37034574,"top":0.6029529,"width":0.008477394,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(Node Package Manager) dependency. In modern Laravel applications,","depth":24,"bounds":{"left":0.31333113,"top":0.6017558,"width":0.10704787,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm","depth":25,"bounds":{"left":0.3472407,"top":0.6444533,"width":0.00831117,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).","depth":24,"bounds":{"left":0.31333113,"top":0.6432562,"width":0.11236702,"height":0.07861133},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is exactly what you need to do to resolve this issue in your project:","depth":24,"bounds":{"left":0.31333113,"top":0.7350359,"width":0.11236702,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Locate the Repository","depth":23,"bounds":{"left":0.31333113,"top":0.7964884,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Locate the Repository","depth":24,"bounds":{"left":0.31333113,"top":0.7980846,"width":0.06266622,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The Vanta dashboard indicates this vulnerability is in a repository or project named","depth":24,"bounds":{"left":0.31333113,"top":0.8244214,"width":0.114527926,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"extension-app","depth":25,"bounds":{"left":0.3153258,"top":0.8671189,"width":0.036236703,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You need to open your terminal and navigate to the root directory of this specific project where the","depth":24,"bounds":{"left":0.31333113,"top":0.8659218,"width":0.10987367,"height":0.057861134},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"bounds":{"left":0.3899601,"top":0.9086193,"width":0.033410903,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file lives.","depth":24,"bounds":{"left":0.31333113,"top":0.9074222,"width":0.11336436,"height":0.037110932},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"2. Identify How the Package is Used","depth":23,"bounds":{"left":0.31333113,"top":0.9688747,"width":0.11502659,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2. Identify How the Package is Used","depth":24,"bounds":{"left":0.31333113,"top":0.97047085,"width":0.092586435,"height":0.016360734},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The package","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.032413565,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"bounds":{"left":0.34773937,"top":0.9980048,"width":0.02244016,"height":0.0019952059},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"might be something your team installed directly, or (more likely) it is a \"transitive dependency\"—meaning another package you use relies on it.","depth":24,"bounds":{"left":0.31333113,"top":0.99680763,"width":0.114527926,"height":0.0031923652},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run this command in your terminal to see how it's being required:","depth":24,"bounds":{"left":0.31333113,"top":1.0,"width":0.11236702,"height":-0.0885874},"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm ls elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This will output a tree showing exactly which package is bringing in the vulnerable version of","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"3. Update the Vulnerable Package","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"3. Update the Vulnerable Package","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You need to update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to a version higher than","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"6.6.1","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":". You have a few options to do this:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option A: The Automated Fix (Recommended First Step)","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the built-in npm audit tool to automatically apply non-breaking updates:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option B: Manual Update","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is a direct dependency in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", run:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"npm update elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Option C: Overriding a Transitive Dependency","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm audit fix","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"doesn't work because","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"elliptic","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"overrides","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"section to your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"JSON","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"{","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"dependencies\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"// your normal dependencies","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"},","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"overrides\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":": {","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"elliptic\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":":","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"\"^6.6.2\"","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"}\n}","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"After adding that, run","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm install","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to regenerate your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"4. Commit and Push","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"4. Commit and Push","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run build","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"or","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"npm run dev","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":").","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If everything works, commit the updated","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"and","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"package-lock.json","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"files and push them to your GitHub repository.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":21,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Redo","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Share & export","depth":20,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":20,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXTextArea","text":"Enter a prompt for Gemini\nencrypted","depth":20,"bounds":{"left":0.31665558,"top":0.8216281,"width":0.10638298,"height":0.01915403},"on_screen":true,"value":"Enter a prompt for Gemini\nencrypted","help_text":"","role_description":"text entry area","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Enter a prompt for Gemini","depth":21,"bounds":{"left":0.32330453,"top":0.82202715,"width":0.069980055,"height":0.018355945},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"encrypted","depth":21,"bounds":{"left":0.31565824,"top":0.8216281,"width":0.0066489363,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Open upload file menu","depth":20,"bounds":{"left":0.31266624,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Tools","depth":18,"bounds":{"left":0.32862368,"top":0.8575419,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Open mode picker","depth":20,"bounds":{"left":0.3856383,"top":0.85514766,"width":0.026097074,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Pro","depth":23,"bounds":{"left":0.39095744,"top":0.8639266,"width":0.007480053,"height":0.014764565},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Microphone","depth":19,"bounds":{"left":0.41373006,"top":0.85514766,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Send message","depth":19,"bounds":{"left":0.42004654,"top":0.85434955,"width":0.013962766,"height":0.033519555},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":false,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.","depth":17,"bounds":{"left":0.30884308,"top":0.90901834,"width":0.11951463,"height":0.025139665},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Your privacy & Gemini Opens in a new window","depth":17,"bounds":{"left":0.39079124,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Your privacy & Gemini","depth":18,"bounds":{"left":0.39079124,"top":0.92178774,"width":0.040059842,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Opens in a new window","depth":19,"bounds":{"left":0.30302528,"top":0.92098963,"width":0.043218084,"height":0.012370312},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Summarize page","depth":7,"bounds":{"left":0.30867687,"top":0.95730245,"width":0.053523935,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Summarize page","depth":9,"bounds":{"left":0.31432846,"top":0.96249,"width":0.042220745,"height":0.015163607},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Skip to:","depth":9,"bounds":{"left":0.44980052,"top":0.07861133,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Top Bar","depth":10,"bounds":{"left":0.44980052,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Top Bar","depth":11,"bounds":{"left":0.44980052,"top":0.097765364,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Sidebar","depth":10,"bounds":{"left":0.44980052,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Sidebar","depth":11,"bounds":{"left":0.44980052,"top":0.11691939,"width":0.016954787,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Main Content","depth":10,"bounds":{"left":0.44980052,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Main Content","depth":11,"bounds":{"left":0.44980052,"top":0.13607343,"width":0.029421542,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Collapse sidebar [","depth":9,"bounds":{"left":0.4431516,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Collapse sidebar [","depth":11,"bounds":{"left":0.44830453,"top":0.06344773,"width":0.039727394,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Switch sites or apps","depth":10,"bounds":{"left":0.45511967,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Switch sites or apps","depth":12,"bounds":{"left":0.4602726,"top":0.06344773,"width":0.044215426,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXLink","text":"Go to your Jira homepage","depth":9,"bounds":{"left":0.46841756,"top":0.057861134,"width":0.029421542,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"link","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXComboBox","text":"Search, press enter to navigate to advanced search with your text query","depth":11,"bounds":{"left":0.5846077,"top":0.06264964,"width":0.24268617,"height":0.015961692},"on_screen":true,"help_text":"","placeholder":"Search","role_description":"combo box","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Create","depth":10,"bounds":{"left":0.835605,"top":0.057861134,"width":0.030086435,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Create","depth":12,"bounds":{"left":0.8469083,"top":0.06384677,"width":0.014793883,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Rovo Ask Rovo","depth":12,"bounds":{"left":0.91240025,"top":0.057861134,"width":0.035904255,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Ask Rovo","depth":14,"bounds":{"left":0.92370343,"top":0.06384677,"width":0.020611702,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"8 Notifications","depth":12,"bounds":{"left":0.9496343,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"8 Notifications","depth":14,"bounds":{"left":0.95478725,"top":0.06344773,"width":0.031914894,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Help","depth":12,"bounds":{"left":0.9616024,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Help","depth":14,"bounds":{"left":0.96675533,"top":0.06344773,"width":0.010139627,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXMenuButton","text":"Settings","depth":12,"bounds":{"left":0.97357047,"top":0.057861134,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"menu button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXStaticText","text":"Settings","depth":14,"bounds":{"left":0.9787234,"top":0.06344773,"width":0.017952127,"height":0.01396648},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
191493080201979933
|
-6107034107928167794
|
visual_change
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true
, your application has access to the vulnerable extension.
2. Check Your PHP Version
2. Check Your PHP Version
If the SOAP extension is enabled, you must check if your PHP version falls within the vulnerable ranges mentioned in the CVE (e.g., versions below 8.2.31, 8.3.31, 8.4.21, or 8.5.6).
In the CLI:
Bash
Download code
Copy code
php -v
In your Laravel App:
PHP
Download code
Copy code
Route::get(
'/check-php'
,
function
(
)
{
dd(phpversion());
});
3. How to Secure Your Environment
3. How to Secure Your Environment
If you are running a vulnerable version of PHP and have the SOAP extension enabled, you have two primary options:
Option A: Update PHP (Recommended)
The best approach is to update your server's PHP binary to a patched version. How you do this depends on your hosting environment:
Laravel Sail / Docker:
Modify the PHP version referenced in your
docker-compose.yml
or Dockerfile, then rebuild your containers using
sail build --no-cache
.
Laravel Forge / Vapor:
Use the respective dashboards to upgrade the PHP version running on your servers or serverless environments.
Ubuntu / Debian Server:
Run standard package manager updates (e.g.,
sudo apt-get update && sudo apt-get upgrade php8.x-soap
).
Option B: Disable the SOAP Extension (Workaround)
If your application does not actually rely on SOAP (for example, if it only uses standard REST APIs), you can completely eliminate the attack surface by disabling the extension.
Find your loaded
php.ini
file by running
php --ini
.
Open the file and locate the line
extension=soap
(or
extension=php_soap.dll
on Windows).
Comment it out by adding a semicolon to the start of the line:
;extension=soap
.
Restart your web server or PHP-FPM service (e.g.,
sudo systemctl restart php8.2-fpm
).
Good response
Bad response
Share & export
Copy
Show more options
Show the uploaded image in a lightbox
Copy prompt
Edit
You said I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
You said
I don't understand what should be done. The task is address BE vulnerabilities and there are some vanta links. What should be done backend wise
Expand
Listen
Show thinking
Gemini said
Gemini said
It makes complete sense why you are confused! You were assigned a task to fix "Backend (BE) vulnerabilities" in your Laravel app, but the screenshot you provided is actually flagging a
JavaScript/Node.js vulnerability
, not a PHP one.
The image shows an alert for
npm-elliptic <= 6.6.1
, which is an
npm
(Node Package Manager) dependency. In modern Laravel applications,
npm
is typically used to manage frontend assets and build tools (like Vite or Laravel Mix), rather than backend PHP code (which uses Composer).
Here is exactly what you need to do to resolve this issue in your project:
1. Locate the Repository
1. Locate the Repository
The Vanta dashboard indicates this vulnerability is in a repository or project named
extension-app
. You need to open your terminal and navigate to the root directory of this specific project where the
package.json
file lives.
2. Identify How the Package is Used
2. Identify How the Package is Used
The package
elliptic
might be something your team installed directly, or (more likely) it is a "transitive dependency"—meaning another package you use relies on it.
Run this command in your terminal to see how it's being required:
Bash
Download code
Copy code
npm ls elliptic
This will output a tree showing exactly which package is bringing in the vulnerable version of
elliptic
.
3. Update the Vulnerable Package
3. Update the Vulnerable Package
You need to update
elliptic
to a version higher than
6.6.1
. You have a few options to do this:
Option A: The Automated Fix (Recommended First Step)
Run the built-in npm audit tool to automatically apply non-breaking updates:
Bash
Download code
Copy code
npm audit fix
Option B: Manual Update
If
elliptic
is a direct dependency in your
package.json
, run:
Bash
Download code
Copy code
npm update elliptic
Option C: Overriding a Transitive Dependency
If
npm audit fix
doesn't work because
elliptic
is deeply nested inside another package that hasn't updated its own dependencies, you can force a newer version by adding an
overrides
section to your
package.json
file:
JSON
Download code
Copy code
{
"dependencies"
: {
// your normal dependencies
},
"overrides"
: {
"elliptic"
:
"^6.6.2"
}
}
After adding that, run
npm install
to regenerate your
package-lock.json
.
4. Commit and Push
4. Commit and Push
Once you have updated the package, verify that your frontend assets still compile successfully (e.g., by running
npm run build
or
npm run dev
).
If everything works, commit the updated
package.json
and
package-lock.json
files and push them to your GitHub repository.
GitHub's Dependabot will automatically detect that the vulnerable version has been replaced and will mark the alert as resolved. Vanta will then sync with GitHub and clear the failing test from your dashboard!
Good response
Bad response
Redo
Share & export
Copy
Show more options
Enter a prompt for Gemini
encrypted
Enter a prompt for Gemini
encrypted
Open upload file menu
Tools
Open mode picker
Pro
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to:
Top Bar
Top Bar
Sidebar
Sidebar
Main Content
Main Content
Collapse sidebar [
Collapse sidebar [
Switch sites or apps
Switch sites or apps
Go to your Jira homepage
Search, press enter to navigate to advanced search with your text query
Create
Create
Rovo Ask Rovo
Ask Rovo
8 Notifications
8 Notifications
Help
Help
Settings
Settings...
|
NULL
|
NULL
|
NULL
|
NULL
|
|
32541
|
1249
|
77
|
2026-05-13T09:26:51.756083+00:00
|
/Users/lukas/.screenpipe/data/data/2026-05-13/1778 /Users/lukas/.screenpipe/data/data/2026-05-13/1778664411756_m2.jpg...
|
Firefox
|
Work item search - Jira — Work
|
1
|
NULL
|
monitor_2
|
NULL
|
NULL
|
NULL
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true...
|
[{"role":"AXRadioButton","text [{"role":"AXRadioButton","text":"Work item search - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.0518755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":true},{"role":"AXStaticText","text":"Work item search - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.06304868,"width":0.040392287,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Close tab","depth":5,"bounds":{"left":0.29105717,"top":0.05905826,"width":0.007978723,"height":0.01915403},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXRadioButton","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.08459697,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19958] Upgrade BE libraries - May - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.09577015,"width":0.07762633,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.11731844,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.12849163,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"jiminny/app/backend-code - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.15003991,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"jiminny/app/backend-code - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.16121309,"width":0.059674203,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"NVD - cve-2026-6722","depth":4,"bounds":{"left":0.2237367,"top":0.18276137,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"NVD - cve-2026-6722","depth":5,"bounds":{"left":0.23703457,"top":0.19393456,"width":0.039228722,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.21548285,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-20773] User Pilot not receiving events on report generated - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.22665602,"width":0.1200133,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.2482043,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.25937748,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Project Phoenix – Figma","depth":4,"bounds":{"left":0.2237367,"top":0.28092578,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Project Phoenix – Figma","depth":5,"bounds":{"left":0.23703457,"top":0.29209897,"width":0.041888297,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":4,"bounds":{"left":0.2237367,"top":0.31364724,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"TypeError: League\\Flysystem\\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app","depth":5,"bounds":{"left":0.23703457,"top":0.32482043,"width":0.40475398,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"New Tab","depth":4,"bounds":{"left":0.2237367,"top":0.3463687,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"New Tab","depth":5,"bounds":{"left":0.23703457,"top":0.3575419,"width":0.014960106,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Userpilot | Ask Jiminny Report Generated","depth":4,"bounds":{"left":0.2237367,"top":0.3790902,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Userpilot | Ask Jiminny Report Generated","depth":5,"bounds":{"left":0.23703457,"top":0.39026338,"width":0.07164229,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.41181165,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[SRD-6848] Sidekick SMS issue - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.42298484,"width":0.06632314,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":4,"bounds":{"left":0.2237367,"top":0.4445331,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"[JY-19957] Upgrade BE libraries - Apr - Jira","depth":5,"bounds":{"left":0.23703457,"top":0.4557063,"width":0.076296546,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":4,"bounds":{"left":0.2237367,"top":0.4772546,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app","depth":5,"bounds":{"left":0.23703457,"top":0.4884278,"width":0.20977394,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.509976,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5211492,"width":0.13796543,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.54269755,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.55387074,"width":0.14378324,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXRadioButton","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":4,"bounds":{"left":0.2237367,"top":0.575419,"width":0.07962101,"height":0.032721467},"on_screen":true,"help_text":"","role_description":"tab","subrole":"AXTabButton","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta","depth":5,"bounds":{"left":0.23703457,"top":0.5865922,"width":0.13680187,"height":0.010774142},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"New Tab","depth":4,"bounds":{"left":0.2265625,"top":0.6097366,"width":0.07413564,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Customize sidebar","depth":6,"bounds":{"left":0.2265625,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Close Google Gemini (⌃X)","depth":6,"bounds":{"left":0.23753324,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Tabs from other devices","depth":6,"bounds":{"left":0.2486702,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open history (⇧⌘H)","depth":6,"bounds":{"left":0.25980717,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Open bookmarks (⌘B)","depth":6,"bounds":{"left":0.27094415,"top":0.97007185,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"AI Chat settings","depth":7,"bounds":{"left":0.4084109,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Close","depth":7,"bounds":{"left":0.42037898,"top":0.055067837,"width":0.010638298,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"WORK, Google Account: lukas.kovalik@jiminny.com","depth":12,"bounds":{"left":0.41771942,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXButton","text":"Main menu","depth":12,"bounds":{"left":0.3073471,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"New Chat","depth":12,"bounds":{"left":0.38979387,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Open menu for conversation actions.","depth":12,"bounds":{"left":0.40309176,"top":0.103751,"width":0.013297873,"height":0.031923383},"on_screen":true,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false,"is_expanded":false},{"role":"AXHeading","text":"Conversation with Gemini","depth":15,"bounds":{"left":0.30302528,"top":0.14764565,"width":0.0003324468,"height":0.0007980846},"on_screen":true,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Conversation with Gemini","depth":16,"bounds":{"left":0.30302528,"top":0.15003991,"width":0.1200133,"height":0.025538707},"on_screen":true,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Metrics","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NVD enrichment efforts reference publicly available information to associate","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"vector strings. CVSS information contributed by other sources is also","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"displayed.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.x Severity and Vector Strings:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"NIST: NVD","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"References to Advisories, Solutions, and Tools","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"By selecting these links, you will be leaving NIST webspace.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"We have provided these links to other web sites because they","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"may have information that would be of interest to you. No","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"inferences should be drawn on account of other sites being","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"referenced, or not, from this page. There may be other web","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"sites that are more appropriate for your purpose. NIST does","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"not necessarily endorse the views expressed, or concur with","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"the facts presented on these sites. Further, NIST does not","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"endorse any commercial products that may be mentioned on","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"these sites. Please address comments about this page to nvd@nist.gov.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"URL","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Tag(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vendor Advisory","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Enumeration","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-ID","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE Name","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Source","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Use After Free","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP Group","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Known Affected Software Configurations Switch","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"to CPE 2.2","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"From (including)8.5.0Up to (excluding)8.5.6","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Denotes Vulnerable Software","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Are we missing a CPE here? Please let us know.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Change History","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"2 change records found show changes</selection>” selected.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Expand","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Summary of CVE-2026-6722","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Summary of CVE-2026-6722","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vulnerability Overview","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Technical Mechanism","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Root Cause:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"When processing an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"apache:Map","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"node with duplicate keys, the second entry overwrites the first in a temporary result map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Memory Corruption:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"This overwrite frees the original PHP object, but a \"stale\" (dangling) pointer remains in the global map.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Exploitation:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"An attacker can use an","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"href","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Impact:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Successful exploitation allows for","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Remote Code Execution (RCE)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":".","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Risk Assessment","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS 3.1 Score:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"9.8 (Critical)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Vector:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","depth":27,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Weakness Type:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"CWE-416 (Use After Free)","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Affected Software","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The following PHP versions are vulnerable:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.2.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.2.0 up to (but excluding) 8.2.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.3.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.3.0 up to (but excluding) 8.3.31","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.4.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.4.0 up to (but excluding) 8.4.21","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"8.5.x:","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Versions 8.5.0 up to (but excluding) 8.5.6","depth":26,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Solution","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXCheckBox","text":"Good response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXCheckBox","text":"Bad response","depth":22,"on_screen":false,"help_text":"","role_description":"toggle button","subrole":"AXToggle","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Share & export","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy","depth":22,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Show more options","depth":21,"on_screen":false,"role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy prompt","depth":21,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXHeading","text":"You said how can I do it? I am in laravel app.","depth":21,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"You said","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"how can I do it? I am in laravel app.","depth":23,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Listen","depth":22,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Show thinking","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"Gemini said","depth":20,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Gemini said","depth":21,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Here is how you can assess your risk and secure your application.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXHeading","text":"1. Check if the SOAP Extension is Enabled","depth":23,"on_screen":false,"help_text":"","role_description":"heading","subrole":"AXUnknown"},{"role":"AXStaticText","text":"1. Check if the SOAP Extension is Enabled","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via the Command Line (CLI):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Run the following command in your terminal. If it outputs","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":", the extension is enabled for your CLI.","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"Bash","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"php -m | grep soap","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"To check via your Laravel App (Web Server):","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"The web server (like PHP-FPM or Apache) might use a different","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"php.ini","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file than your CLI. To be certain, temporarily add this to a route in your","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"routes/web.php","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"file and visit it in your browser:","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"PHP","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXButton","text":"Download code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXButton","text":"Copy code","depth":25,"on_screen":false,"help_text":"","role_description":"button","subrole":"AXUnknown","is_enabled":true,"is_focused":false,"is_selected":false},{"role":"AXStaticText","text":"Route::get(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'/check-soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":",","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"function","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":")","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"{\n dd(extension_loaded(","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"'soap'","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"));\n});","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"If this returns","depth":24,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"},{"role":"AXStaticText","text":"true","depth":25,"on_screen":false,"help_text":"","role_description":"text","subrole":"AXUnknown"}]...
|
-4072337551878961865
|
-6107069294712505714
|
click
|
accessibility
|
NULL
|
Work item search - Jira
Work item search - Jira
Cl Work item search - Jira
Work item search - Jira
Close tab
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6722
NVD - cve-2026-6722
[JY-20773] User Pilot not receiving events on report generated - Jira
[JY-20773] User Pilot not receiving events on report generated - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
Project Phoenix – Figma
Project Phoenix – Figma
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
TypeError: League\Flysystem\Filesystem::has(): Argument #1 ($location) must be of type string, null given, called in /home/jiminny/vendor/laravel/framework/src/Illuminate/Filesystem/FilesystemAdapter.php on line 218 — jiminny — app
New Tab
New Tab
Userpilot | Ask Jiminny Report Generated
Userpilot | Ask Jiminny Report Generated
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
[JY-19957] Upgrade BE libraries - Apr - Jira
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
JY-19957 | Remove abanded sympfony debug, compose upgrade by nikolaybiaivanov · Pull Request #12022 · jiminny/app
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
WORK, Google Account: [EMAIL]
Main menu
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
Copy prompt
You said I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5 PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-416 Use After Free PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2026-6722</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-85c2-q967-79q5
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-416
Use After Free
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Listen
Gemini said
Gemini said
Summary of CVE-2026-6722
Summary of CVE-2026-6722
Vulnerability Overview
A Use-After-Free (UAF) vulnerability exists in the PHP SOAP extension due to a flaw in its object deduplication mechanism. The system stores pointers to PHP objects in a global map without properly incrementing their reference counts, leading to memory corruption.
Technical Mechanism
Root Cause:
When processing an
apache:Map
node with duplicate keys, the second entry overwrites the first in a temporary result map.
Memory Corruption:
This overwrite frees the original PHP object, but a "stale" (dangling) pointer remains in the global map.
Exploitation:
An attacker can use an
href
reference to the freed node to copy the dangling pointer. By manipulating SOAP request bodies, an attacker can reclaim that memory region with PHP string allocations.
Impact:
Successful exploitation allows for
Remote Code Execution (RCE)
.
Risk Assessment
CVSS 3.1 Score:
9.8 (Critical)
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Type:
CWE-416 (Use After Free)
Affected Software
The following PHP versions are vulnerable:
8.2.x:
Versions 8.2.0 up to (but excluding) 8.2.31
8.3.x:
Versions 8.3.0 up to (but excluding) 8.3.31
8.4.x:
Versions 8.4.0 up to (but excluding) 8.4.21
8.5.x:
Versions 8.5.0 up to (but excluding) 8.5.6
Solution
Users should update to the patched versions (8.2.31, 8.3.31, 8.4.21, or 8.5.6) as identified in the vendor advisory.
Good response
Bad response
Share & export
Copy
Show more options
Copy prompt
You said how can I do it? I am in laravel app.
You said
how can I do it? I am in laravel app.
Listen
Show thinking
Gemini said
Gemini said
I cannot provide exploit instructions or payloads for CVE-2026-6722. I can, however, show you how to check if your Laravel application's environment is vulnerable and how to secure it against this threat.
Because this is a vulnerability in PHP's core C code (specifically the SOAP extension) rather than in Laravel's PHP code, fixing it requires evaluating your server environment.
Here is how you can assess your risk and secure your application.
1. Check if the SOAP Extension is Enabled
1. Check if the SOAP Extension is Enabled
Laravel does not use or require the PHP SOAP extension by default. Your application is only at risk if the extension is enabled and your application is parsing untrusted SOAP requests (e.g., through a specific package or custom integration).
To check via the Command Line (CLI):
Run the following command in your terminal. If it outputs
soap
, the extension is enabled for your CLI.
Bash
Download code
Copy code
php -m | grep soap
To check via your Laravel App (Web Server):
The web server (like PHP-FPM or Apache) might use a different
php.ini
file than your CLI. To be certain, temporarily add this to a route in your
routes/web.php
file and visit it in your browser:
PHP
Download code
Copy code
Route::get(
'/check-soap'
,
function
(
)
{
dd(extension_loaded(
'soap'
));
});
If this returns
true...
|
32539
|
NULL
|
NULL
|
NULL
|