{"vulnerability": "CVE-2026-17544", "sightings": [{"uuid": "adef368b-f4c6-4553-9f49-3416b4384e1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2ojh2ibweiexi", "content": "CVE-2026-17544 - Out-of-bounds write in bccomp() via crafted operand and scale\nCVE ID : CVE-2026-17544\n \n Published : July 30, 2026, 11:22 a.m. | 22\u00a0minutes ago\n \n Description : Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corru...", "creation_timestamp": "2026-07-30T12:17:04.995837Z"}, {"uuid": "d2a58b8d-24fe-4f0f-8246-187957ef4a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mrwxyq3z2x23", "content": "\ud83d\udd17 CVE : CVE-2026-17543, CVE-2026-17544, CVE-2026-7260, CVE-2026-9672", "creation_timestamp": "2026-07-31T12:40:13.497747Z"}, {"uuid": "53cb1848-470c-47c0-a4a8-36757717301f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mry2xtazhk2l", "content": "CVE-2026-17544 - php8.4\nA flaw in Debian's sudo configuration allows an attacker to gain elevated privileges on affected systems. This can happen if an attacker gains access to a user account that has\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#php84 #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-07-31T23:06:04.371235Z"}, {"uuid": "71cdd5c8-63f3-4423-af91-fc9c6fb552a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://t.me/GithubRedTeam/97769", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-17544-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:48:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-17544 \u2014 PHP bcmath bccomp() OOB write (stack smashing). Verified: crash on 8.4.23/8.5.8, fixed in 8.4.24. GHSA-x692-q9x7-8c3f\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-12T19:00:03.574469Z"}, {"uuid": "5e4ba8cc-0252-45a5-9330-4abc3efc5967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/97769", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-17544-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Boreas37\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-12 17:48:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-17544 \u2014 PHP bcmath bccomp() OOB write (stack smashing). Verified: crash on 8.4.23/8.5.8, fixed in 8.4.24. GHSA-x692-q9x7-8c3f\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-13T00:00:06.661023Z"}, {"uuid": "0651b70b-4021-4b6c-9eeb-dba7e52b04bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-17T18:00:05.924416Z"}, {"uuid": "6d4b986b-b9ef-4e9b-a422-11b6144bdd61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "Telegram/9qYdJNeZ50siptVHrqc-g91N4K0CPGozDwGl0Etd8sr4-fM", "content": "", "creation_timestamp": "2026-08-15T08:00:06.751887Z"}, {"uuid": "9a4d2be4-fc0c-4c8e-969a-ac850d0689de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "published-proof-of-concept", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-18T00:00:10.330712Z"}, {"uuid": "ea0ad44c-cd24-4818-9ad8-84f85e9972b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3msgvgxwa7s2y", "content": "\ud83d\udccc CVE-2026-17544 - Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and ... https://www.cyberhub.blog/cves/CVE-2026-17544", "creation_timestamp": "2026-08-06T20:37:06.597067Z"}, {"uuid": "6dcfa66b-c727-4a6c-ba95-1ddd4c1b8df5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "published-proof-of-concept", "source": "Telegram/9qYdJNeZ50siptVHrqc-g91N4K0CPGozDwGl0Etd8sr4-fM", "content": "", "creation_timestamp": "2026-08-16T00:00:22.275826Z"}, {"uuid": "93701561-70c1-415e-994c-23678ebc219b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://t.me/GithubRedTeam/98244", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-17544\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a r2qa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 22:28:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-17544: PHP bcmath OOB write \u2192 universal memory-only RCE & disable_functions/open_basedir bypass. Offset-free runtime resolver. Verified on   PHP 8.4.x / 8.5.x.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:08.132149Z"}, {"uuid": "9404ae5d-28db-4aca-85a3-2a0fa061d628", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://t.me/GithubRedTeam/98244", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-17544\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a r2qa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 22:28:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-17544: PHP bcmath OOB write \u2192 universal memory-only RCE & disable_functions/open_basedir bypass. Offset-free runtime resolver. Verified on   PHP 8.4.x / 8.5.x.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:32.785997Z"}, {"uuid": "e484210c-1075-43a9-bc6f-bf3637ef5320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98244", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-17544\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a r2qa\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PHP\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 22:28:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-17544: PHP bcmath OOB write \u2192 universal memory-only RCE & disable_functions/open_basedir bypass. Offset-free runtime resolver. Verified on   PHP 8.4.x / 8.5.x.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:11.009490Z"}, {"uuid": "14902ebb-20bf-48d1-9877-b3042c6980ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0375", "content": "Oracle heeft 31 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module - ASR, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Communications-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00ebrend van laag tot kritiek. Van de in totaal 31 kwetsbaarheden zijn vier als kritiek aangemerkt en kunnen 23 kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe vier kwetsbaarheden die als kritiek zijn aangemerkt, CVE-2026-44024, CVE-2026-17544, CVE-2026-71290 en CVE-2026-73194, hebben een CVSS-score van 9,1 of hoger en bevinden zich in verschillende Core-componenten van Oracle Communications Unified Assurance, waaronder Fluentd, PHP, Apache HttpClient en DBI. Deze kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt en kunnen een hoge impact hebben op de vertrouwelijkheid en, afhankelijk van de kwetsbaarheid, de integriteit en beschikbaarheid van getroffen systemen.\n\nHet NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.", "creation_timestamp": "2026-09-16T16:00:44.608299Z"}, {"uuid": "be447585-d05f-466f-a5c8-4332f9f3face", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-17544", "type": "seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0375", "content": "Oracle heeft 31 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module - ASR, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor. De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Communications-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00ebrend van laag tot kritiek. Van de in totaal 31 kwetsbaarheden zijn vier als kritiek aangemerkt en kunnen 23 kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe vier kwetsbaarheden die als kritiek zijn aangemerkt, CVE-2026-44024, CVE-2026-17544, CVE-2026-71290 en CVE-2026-73194, hebben een CVSS-score van 9,1 of hoger en bevinden zich in verschillende Core-componenten van Oracle Communications Unified Assurance, waaronder Fluentd, PHP, Apache HttpClient en DBI. Deze kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt en kunnen een hoge impact hebben op de vertrouwelijkheid en, afhankelijk van de kwetsbaarheid, de integriteit en beschikbaarheid van getroffen systemen.\n\nHet NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.", "creation_timestamp": "2026-09-17T01:00:39.162417Z"}]}