This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · PHP

PHP Vulnerabilities

The latest security flaws in PHP, which ones attackers are using, and whether your PHP version is affected or out of support.

New flaws, 30 days
2
Critical, 8 weeks
1
On CISA's exploited list
5
Latest exploited
26 Oct 2026

Run php -v on the server, or in WordPress see Tools › Site Health › Info › Server.

PHP Security in Short

PHP flaws sit under every site on the server: WordPress, Drupal, Laravel, Magento and everything else. Each PHP release line gets two years of bug fixes and then two years of security-only fixes, after which it gets nothing. Many servers still run lines that stopped getting fixes years ago.

How to Keep PHP Patched

  • Know which release line you're on (php -v) and when it stops getting security fixes. The version check above tells you.
  • On Ubuntu and Debian, PHP comes from the distribution or from Ondřej Surý's packages. Either way, apt upgrade brings in fixes. Restart PHP-FPM afterwards so the running copy is the new one.
  • On shared hosting, choose a supported PHP version in your control panel.
  • Plan upgrades to a new release line well before the old one's end-of-life date. Apps usually need testing first.

The Past Eight Weeks

Any Score 7+ 8+ 9+

4 flaws scored 7+, newest first.

21 Oct 2026 Memory corruption PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reque… CVE-2026-109618 9.8 Exploited

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

Patch now · NVD Record

On Hacker News

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry 270 commentsTell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming 63 commentsPHP session.upload_progress heap UAF (CVE-2026-109618 / -109619) 62 comments
21 Oct 2026 Memory corruption PHP has various global state that temporarily points into request memory. CVE-2026-109619 8.1 Exploited

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

Patch now · NVD Record

On Hacker News

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry 270 commentsTell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming 63 commentsPHP web runtimes (CVE-2026-109618 and CVE-2026-109619) 26 comments
25 Sep 2026 Security flaw On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, … CVE-2026-17545 7.5

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.

Patch this week · NVD Record

25 Sep 2026 Denial of service cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. CVE-2026-91765 7.5

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

Patch this week · NVD Record

Being Exploited

PHP flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 5 on the KEV page.

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions