PHP vulnerabilities7 known to be exploited.
PHP has 756 published vulnerabilities across 34 products in our catalogue. 7 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is PHP, with 725. If you run PHP software, patch the exploited flaws first.
The most recent PHP flaw added to the known-exploited list is CVE-2026-109619, on 26 October 2026. We keep watching the known-exploited list.
Which PHP products have the most vulnerabilities?
PHP leads with 725 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which PHP vulnerabilities are being exploited?
7 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.2PHP Stale Internal Request-State Vulnerability
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
- 9.2PHP Memory Corruption Vulnerability
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
- 9.8PHP-CGI OS Command Injection Vulnerability
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution.
- 7.8PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked.
- 7.5PEAR Archive_Tar Improper Link Resolution Vulnerability
PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links.
- 9.8PHP-CGI Query String Parameter Vulnerability
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
- 8.7PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
Which PHP flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
Unauthenticated remote code execution vulnerability in PHP core, the second of two flaws known as "php2shell".
- >99%
Unauthenticated remote code execution vulnerability in PHP core, the first of two flaws known as "php2shell".
- >99%
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote...
- >99%
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to...
- >99%
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI...
- 96%CVE-2018-19518High
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in...
- 95%CVE-2015-0235Critical
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1)...
- 87%CVE-2018-7584Critical
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in...
- 85%
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
- 83%CVE-2011-4885Medium
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by...
All PHP products we track.
17 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- PHPphp725 vulnerabilities606 versions
- Pearpear5 vulnerabilities84 versions
- Archive Tararchive_tar4 vulnerabilities19 versions
- Blog CMSblog_cms1 vulnerability1 version
- Bloqbloq1 vulnerability1 version
- Errordocserrordocs1 vulnerability1 version
- Ext-HTTPext-http1 vulnerability98 versions
- Imagickimagick1 vulnerability6 versions
- Memcachedmemcached1 vulnerability13 versions
- Mysql Banner Exchangemysql_banner_exchange1 vulnerability1 version
- Pear Archive Tarpear_archive_tar1 vulnerability29 versions
- Pecl HTTPpecl_http1 vulnerability1 version
- Xhprofxhprof1 vulnerability5 versions
- XML Rpcxml_rpc1 vulnerability25 versions
- Comoblogcomoblog0 vulnerabilities1 version
- Frankenphpfrankenphp0 vulnerabilities41 versions
- Phorumphorum0 vulnerabilities1 version
This directory lists the 17 PHP products with at least one tracked version, of 34 in our catalogue.
Running PHP? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
- Matched to
- PHP on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 756 published vulnerabilities across 34 products and 933 versions from PHP. The most recent PHP flaw added to the known-exploited list is CVE-2026-109619, on 26 October 2026.
7 PHP vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-109619, CVE-2026-109618 and CVE-2024-4577. The full list is on this page.
PHP, with 725 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the PHP products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.