PHP vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited PHP flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-109619 PHP Stale Internal Request-StateExploited since Oct 26, 2026 · CVSS 9.2
• CVE-2026-109618 PHP Memory CorruptionExploited since Oct 26, 2026 · CVSS 9.2
• CVE-2016-10033 PHPMailer Command InjectionExploited since Jul 7, 2025 · CVSS 9.8
• CVE-2024-4577 PHP-CGI OS Command InjectionExploited since Jun 12, 2024 · ransomware · CVSS 9.8
• CVE-2019-11043 PHP FastCGI Process Manager (FPM) Buffer OverflowExploited since Mar 25, 2022 · ransomware · CVSS 8.7
• CVE-2012-1823 PHP-CGI Query String ParameterExploited since Mar 25, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-109619 PHP Stale Internal Request-StateExploited · Critical 9.2 · Oct 21, 2026
• CVE-2026-109618 PHP Memory CorruptionExploited · Critical 9.2 · Oct 21, 2026
• CVE-2026-82416 FrankenPHP is a modern application server for PHP.High 7.7 · Oct 13, 2026
• CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit.High 7.5 · Sep 25, 2026
• CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.*High 8.1 · Jul 30, 2026
• CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* befoHigh 8.1 · Jul 30, 2026
• CVE-2026-45062 FrankenPHP is a modern application server for PHP.High 8.1 · Jun 10, 2026
• CVE-2026-6735 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attackeHigh 7.3 · May 10, 2026
• CVE-2026-6722 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism storeCritical 9.5 · May 10, 2026
• CVE-2025-14179 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes whenHigh 7.4 · May 10, 2026
• CVE-2026-24895 FrankenPHP is a modern application server for PHP.High 8.9 · Feb 12, 2026
• CVE-2026-24894 FrankenPHP is a modern application server for PHP.High 8.7 · Feb 12, 2026
• CVE-2025-14180 In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver withHigh 8.2 · Dec 27, 2025
• CVE-2024-11235 In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-freeCritical 9.2 · Apr 4, 2025
• CVE-2022-31631 In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying Critical 9.1 · Feb 12, 2025
• CVE-2024-11236 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cCritical 9.8 · Nov 23, 2024
• CVE-2024-8932 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cCritical 9.8 · Nov 22, 2024
• CVE-2024-48581 File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component.Critical 9.8 · Oct 25, 2024
• CVE-2024-48580 SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the email parameter of the logCritical 9.8 · Oct 25, 2024
• CVE-2024-48579 SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username paraCritical 9.8 · Oct 25, 2024
• CVE-2024-8927 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is beingHigh 7.5 · Oct 8, 2024
• CVE-2024-8926 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes High 8.1 · Oct 8, 2024
• CVE-2024-4577 PHP-CGI OS Command InjectionExploited · Critical 9.8 · Jun 9, 2024
• CVE-2024-5585 In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spacHigh 7.7 · Jun 9, 2024
• CVE-2024-2757 In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space.High 7.5 · Apr 29, 2024