Product by Debian
Php8.4
30 known vulnerabilities in Php8.4 (Debian), 2 of them actively exploited (CISA KEV).
Key figures
30
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-109618 | RCE via OOM corruption In CISA KEValso in 12 other products | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state In CISA KEValso in 12 other products | 8.1 | |
| Medium | CVE-2026-12184 | open source PHP: security vulnerability | — | |
| Critical | CVE-2026-6722 | Use-After-Free in SOAP using Apache map | 9.8 | |
| Critical | CVE-2026-17544 | Out-of-bounds write in bccomp() via crafted operand and scale | 9.8 | |
| High | CVE-2026-7262 | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | 7.5 | |
| Medium | CVE-2026-91768 | PHP: Incomplete Comparison with Missing Factors | 6.5 | |
| Critical | CVE-2025-14179 | SQL injection in pdo_firebird via NUL bytes in quoted strings | 9.8 | |
| Critical | CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | 9.8 | |
| High | CVE-2025-14180 | NULL Pointer Dereference in PDO quoting | 7.5 | |
| Critical | CVE-2026-6104 | Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding | 9.1 | |
| High | CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | 7.5 | |
| Critical | CVE-2026-7261 | SoapServer session-persisted object use-after-free via SOAP header fault | 9.8 | |
| Medium | CVE-2025-14181 | Integer overflow to buffer overflow in soap HTTP parsing | 6.5 | |
| High | CVE-2026-7568 | Signed integer overflow in metaphone() | 7.5 | |
| High | CVE-2025-14177 | Information Leak of Memory in getimagesize | 7.5 | |
| Medium | CVE-2026-91766 | Cross-origin credential leak in HTTP stream wrapper redirects | 5.9 | |
| Medium | CVE-2026-93682 | PHP: Out-of-bounds Read | 5.8 | |
| Medium | CVE-2026-91767 | Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | 6.5 | |
| High | CVE-2026-7258 | Out-of-bounds read in urldecode() on NetBSD | 7.5 | |
| High | CVE-2026-7263 | DoS attack via DOMNode::C14N() | 7.5 | |
| Medium | CVE-2026-92842 | OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | 5.9 | |
| High | CVE-2025-14178 | Heap buffer overflow in array_merge() | 6.5 | |
| High | CVE-2026-6735 | XSS within PHP-FPM status endpoint | 6.1 | |
| Medium | CVE-2026-14355 | ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD | 5.6 |
News
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Executionthehackernews,
- PHP2Shell security flaws now sucessfully exploited in the wildbleepingcomputer,
- PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activitythehackernews,
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,
- Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAFvmware-security,