Product by PHP Group
PHP
737 known vulnerabilities in PHP (PHP Group), 3 of them actively exploited (CISA KEV).
Key figures
737
Vulnerabilities
3
Actively exploited (KEV)
2
Used by ransomware
134
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2024-4577 | Argument Injection in PHP-CGI In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2019-11043 | Underflow in PHP-FPM can lead to RCE In CISA KEVRansomware | 8.7 | |
| Critical | CVE-2012-1823 | PHP-CGI Query String Parameter Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2026-109618 | RCE via OOM corruption | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state | 8.1 | |
| Critical | CVE-2024-1874 | Command injection via array-ish $command parameter of proc_open() | 9.4 | |
| Critical | CVE-2018-7584 | PHP: security vulnerability | 9.8 | |
| Critical | CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | |
| Critical | CVE-2016-3078 | PHP: Heap-Based Buffer Overflow | 9.8 | |
| Critical | CVE-2015-6834 | PHP: Use-After-Free | 9.8 | |
| Critical | CVE-2016-7479 | PHP 7.x: Use-After-Free | 9.8 | |
| Critical | CVE-2016-7480 | PHP: Use of Uninitialized Memory | 9.8 | |
| Critical | CVE-2016-3074 | Libgd Libgd: Heap-Based Buffer Overflow | 9.8 | |
| Critical | CVE-2015-6835 | PHP: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2016-3141 | PHP: Deserialization of Untrusted Data | 9.8 | |
| High | CVE-2024-5585 | Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) | 7.7 | |
| Critical | CVE-2015-8617 | PHP: Format String | 9.8 | |
| Critical | CVE-2016-4071 | PHP: Format String | 9.8 | |
| Critical | CVE-2007-1399 | PHP: Stack-Based Buffer Overflow | 9.8 | |
| Critical | CVE-2024-3566 | Node.js: Command Injection | 9.8 | |
| Critical | CVE-2017-5340 | PHP: Integer Overflow | 9.8 | |
| Critical | CVE-2016-7124 | PHP: Denial of Service | 9.8 | |
| Critical | CVE-2015-4643 | PHP: Heap-Based Buffer Overflow | 9.8 | |
| Critical | CVE-2016-5771 | PHP: Use-After-Free | 9.8 | |
| Critical | CVE-2007-1383 | PHP: Integer Overflow | 9.8 |
News
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,
- Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAFvmware-security,
- Two critical PHP flaws put the web on alert as emergency patches arrivecsoonline,
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensorssecurityweek,
- PHP ships emergency patches for critical PHP2Shell flawsbleepingcomputer,