PHP Group

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 8.1HighOct 21, 2026PHP Memory corruptionCVE-2026-109619PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).Added to KEV Oct 26, 2026 · 4 days after publicationExploited5.8% likelyExploit codeNucleiDetection
• 9.8CriticalOct 21, 2026PHP Memory corruptionCVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).Added to KEV Oct 26, 2026 · 4 days after publicationExploited5.3% likelyExploit codeExploit-DB · NucleiDetection
• 9.8CriticalJun 9, 2024PHP Code / command injectionCVE-2024-4577PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.Added to KEV Jun 12, 2024 · 2 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

• 8.1HighOct 21, 2026PHP Memory corruptionCVE-2026-109619PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).Exploited5.8% likelyExploit codeNucleiDetection
• 9.8CriticalOct 21, 2026PHP Memory corruptionCVE-2026-109618PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).Exploited5.3% likelyExploit codeExploit-DB · NucleiDetection
• 6.3MediumMar 30, 2025PHP Memory corruptionCVE-2025-1861In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC91
• 6.3MediumMar 30, 2025PHPCVE-2025-1736In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
• 9.8CriticalJun 9, 2024PHP Code / command injectionCVE-2024-4577PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

See every PHP Group entry on the dashboard.

Top products

• PHP2 CVEs in the last year, 1 critical, 2 exploited

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Cisco PSIRT · Oct 30, 2026Vulnerabilities in PHP Affecting Cisco Products: October 2026CVE-2026-109618CVE-2026-109619
• Cloudflare Zero Wire · Oct 30, 2026php2shell (Needs attention)CVE-2026-109618CVE-2026-109619
• oss-security · Oct 27, 2026Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)CVE-2026-109618
• oss-security · Oct 27, 2026Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)CVE-2026-109618
• Oracle · Oct 26, 2026Oracle Security Alert Advisory for CVE-2026-109618 and CVE-2026-109619CVE-2026-109618CVE-2026-109619
• oss-security · Oct 26, 2026Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)CVE-2026-109618
• CISA · Oct 26, 2026CISA Adds Two Known Exploited Vulnerabilities to CatalogCVE-2026-109618CVE-2026-109619
• CISA · Oct 26, 2026CISA Adds Two Known Exploited Vulnerability to CatalogCVE-2026-109618CVE-2026-109619
• oss-security · Oct 26, 2026Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)CVE-2026-109618
• Juniper SIRT · Oct 26, 20262026-10 Reference Advisory: Status of PHP2Shell vulnerabilities on Juniper Products (CVE-2026-109618, CVE-2026-109619)CVE-2026-109618CVE-2026-109619
• oss-security · Oct 24, 2026PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618)CVE-2026-109618CVE-2026-109619
• Palo Alto Networks · Oct 23, 2026CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: HIGH)CVE-2026-109618CVE-2026-109619
• Cisco PSIRT · Oct 22, 2026Vulnerabilities in PHP Affecting Cisco Products: October 2026CVE-2026-109618CVE-2026-109619
• CERT/CC · Oct 22, 2026VU#763488: Memory corruption vulnerabilities in PHPCVE-2026-109618CVE-2026-109619
• Synology · Oct 22, 2026Synology-SA-26:14 PHP2ShellCVE-2026-109618CVE-2026-109619