Product by Ubuntu
Php5
12 known vulnerabilities in Php5 (Ubuntu), 2 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-109618 | RCE via OOM corruption In CISA KEValso in 12 other products | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state In CISA KEValso in 12 other products | 8.1 | |
| Medium | CVE-2026-91768 | PHP: Incomplete Comparison with Missing Factors | 6.5 | |
| High | CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | 7.5 | |
| Medium | CVE-2025-14181 | Integer overflow to buffer overflow in soap HTTP parsing | 6.5 | |
| Medium | CVE-2026-91766 | Cross-origin credential leak in HTTP stream wrapper redirects | 5.9 | |
| Medium | CVE-2026-93682 | PHP: Out-of-bounds Read | 5.8 | |
| Medium | CVE-2026-91767 | Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | 6.5 | |
| Medium | CVE-2026-92842 | OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | 5.9 | |
| Medium | CVE-2026-91769 | TLS Hostname Verification Falls Back to CN After SAN Mismatch | 4.3 | |
| Medium | CVE-2025-1218 | Various packet overreads in mysqlnd_writeprotocol.c | 3.4 | |
| Medium | CVE-2026-6103 | Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection | 4.0 |
News
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Executionthehackernews,
- PHP2Shell security flaws now sucessfully exploited in the wildbleepingcomputer,
- PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activitythehackernews,
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,
- Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAFvmware-security,