Threats
PHP-relevant vulnerabilities and actively exploited issues, each tied to its canonical source. Scan your own site free on the home page.
Upcoming Critical PHP Security Release
Unrated · PHP.net News · 2026-10-22
#StopRansomware: SafePay Ransomware CISA KEV
High · CISA Cybersecurity Advisories · 2026-10-22
Security advisory: Critical remote code execution vulnerabilities, update now
Critical · CVSS 9.2 · PHP {'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'} · PHP.net News · 2026-10-22
PHP 8.5.12 Released!
Critical · CVSS 9.2 · PHP {'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'} · PHP.net News · 2026-10-22
PHP 8.5.11 Released!
Unrated · PHP {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'} · PHP.net News · 2026-10-22
PHP 8.4.27 Released!
Critical · CVSS 9.2 · PHP {'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'} · PHP.net News · 2026-10-22
PHP 8.4.26 Released!
Unrated · PHP {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'} · PHP.net News · 2026-10-22
PHP 8.3.36 Released!
Critical · CVSS 9.2 · PHP {'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'} · PHP.net News · 2026-10-22
PHP 8.3.35 Released!
Unrated · PHP {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'} · PHP.net News · 2026-10-22
PHP 8.2.35 Released!
Critical · CVSS 9.2 · PHP {'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'} · PHP.net News · 2026-10-22
PHP 8.2.34 Released!
Unrated · PHP {'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'} · PHP.net News · 2026-10-22
Cachet has Stored XSS in Incident Component
Medium · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
Medium · CVSS 5.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Medium · CVSS 4.8 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
High · CVSS 8.7 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
High · CVSS 7.5 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
High · CVSS 8.5 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
Medium · CVSS 6.5 · PHP {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'} · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
High · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
High · CVSS 8.6 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
High · CVSS 7.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: Improper access control in the preview links module
Medium · CVSS 4.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
High · CVSS 8.2 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
High · CVSS 8.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
High · CVSS 7.2 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: Path traversal in the images controller
Medium · CVSS 5.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: The registration module re-sends activation mails
Medium · CVSS 5.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Medium · CVSS 4.8 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences
Medium · CVSS 6.5 · PHP {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'} · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
Medium · CVSS 6.4 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
High · CVSS 7.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Laravel: XSS in Debug Page Information
Low · CVSS 3.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Medium · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Snipe-IT: 2FA bypass via the API token flow
High · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Solspace Freeform: Limited Twig template injection via submitted field values
Medium · CVSS 5.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
Critical · CVSS 9.8 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
High · CVSS 7.5 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
YOURLS: Unauthenticated File Inclusion
Medium · CVSS 5.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
High · CVSS 7.5 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Low · CVSS 3.5 · PHP {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'} · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token
Medium · CVSS 6.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
Medium · CVSS 5.4 · PHP {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'} · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Formie: Missing authorization on sent notification resend modal exposes submission PII
High · CVSS 7.7 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
Medium · CVSS 6.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: Cross-site request forgery in custom backend actions
Low · CVSS 3.5 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
Medium · CVSS 6.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
Medium · CVSS 6.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
phpMyFAQ's two-factor authentication login bypasses the password factor
High · CVSS 8.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs
Medium · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Low · CVSS 3.1 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Medium · CVSS 5.4 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: Cross-site scripting in the comments bundle
Critical · CVSS 9.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost
Medium · CVSS 5.4 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Medium · CVSS 6.5 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Contao: Improper access control in the table access voter
Medium · CVSS 4.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
High · CVSS 8.2 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
High · CVSS 8.8 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Medium · CVSS 4.3 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
High · CVSS 7.5 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
High · CVSS 8.7 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
zbateson/mail-mime-parser has CRLF header injection via attachment filename
High · CVSS 7.2 · GitHub Global Security Advisories (Composer ecosystem) · 2026-10-22
Microsoft Windows Command Injection Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Plex Media Server External Control of File Name or Path Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Cisco Secure Email Gateway Relative Path Traversal Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Siemens Software Center Uncontrolled Search Path Element Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Ahsay AhsayCBS Command Injection Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Ahsay AhsayCBS Improper Authentication Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Fortinet FortiMail Path Traversal Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Zammad GmbH Zammad Improper Privilege Management Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Zammad GmbH Zammad Session Fixation Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Palo Alto Networks PAN-OS Code Injection Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Fortinet Multiple Products Path Traversal Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Strapi Cleartext Storage of Sensitive Information Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
ONLYOFFICE Docs Server Path Traversal Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Apache Struts Command Injection Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
ISC BIND Data Processing Errors Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
ProFTPD Improper Access Control Vulnerability CISA KEV
High · CISA Known Exploited Vulnerabilities Catalog · 2026-10-22
Critical Vulnerabilities in PHP Require Immediate Patching
Critical · CVSS 9.2 · PHP {'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'} · CISA Cybersecurity Advisories · 2026-10-22
CISA Malcolm
Unrated · CISA Cybersecurity Advisories · 2026-10-22
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Unrated · CISA Cybersecurity Advisories · 2026-10-22