# PHP.

Every CVE that names PHP among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [RCE via stale global state](https://agentprime.io/advisories/CVE-2026-109619.md)
  `CVE-2026-109619` · CVE record: PHP Group PHP · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption, CWE-755, CWE-1325, CWE-1419
- [RCE via OOM corruption](https://agentprime.io/advisories/CVE-2026-109618.md)
  `CVE-2026-109618` · CVE record: PHP Group PHP · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption, CWE-755, CWE-1325, CWE-1419
- [OOB read / info leak in convert.\* stream filters when line-break-chars contains NUL](https://agentprime.io/advisories/CVE-2026-92842.md)
  `CVE-2026-92842` · CVE record: PHP Group PHP · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Memory corruption
- [IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)](https://agentprime.io/advisories/CVE-2026-91768.md)
  `CVE-2026-91768` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-1023
- [TLS Hostname Verification Falls Back to CN After SAN Mismatch](https://agentprime.io/advisories/CVE-2026-91769.md)
  `CVE-2026-91769` · CVE record: PHP Group PHP · CVSS 4.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Weak cryptography or TLS
- [Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN](https://agentprime.io/advisories/CVE-2026-91767.md)
  `CVE-2026-91767` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Memory corruption
- [Various packet overreads in mysqlnd_writeprotocol.c](https://agentprime.io/advisories/CVE-2025-1218.md)
  `CVE-2025-1218` · CVE record: PHP Group PHP · CVSS 3.4 Low · Not analysed yet · Published 25 Sept 2026 · Tags: Memory corruption
- [Cross-origin credential leak in HTTP stream wrapper redirects](https://agentprime.io/advisories/CVE-2026-91766.md)
  `CVE-2026-91766` · CVE record: PHP Group PHP · CVSS 5.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [SOAP: Unbounded Recursion in Server-Side cleanup_xml_node](https://agentprime.io/advisories/CVE-2026-91765.md)
  `CVE-2026-91765` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Denial of service
- [Integer overflow to buffer overflow in soap HTTP parsing](https://agentprime.io/advisories/CVE-2025-14181.md)
  `CVE-2025-14181` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Memory corruption
- [PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS](https://agentprime.io/advisories/CVE-2026-17545.md)
  `CVE-2026-17545` · CVE record: PHP Group PHP · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-67
- [Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection](https://agentprime.io/advisories/CVE-2026-6103.md)
  `CVE-2026-6103` · CVE record: PHP Group PHP · CVSS 4.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header](https://agentprime.io/advisories/CVE-2026-93682.md)
  `CVE-2026-93682` · CVE record: PHP Group PHP · CVSS 5.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Memory corruption
- [Stack overflow in phar with circular symlinks](https://agentprime.io/advisories/CVE-2026-7260.md)
  `CVE-2026-7260` · CVE record: PHP Group PHP · CVSS 5.4 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Memory corruption
- [Out-of-bounds write in bccomp() via crafted operand and scale](https://agentprime.io/advisories/CVE-2026-17544.md)
  `CVE-2026-17544` · CVE record: PHP Group PHP · CVSS 8.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: Memory corruption
- [SQL injection in ext-pgsql via E'...' backslash breakout](https://agentprime.io/advisories/CVE-2026-17543.md)
  `CVE-2026-17543` · CVE record: PHP Group PHP · CVSS 8.1 High · Not analysed yet · Published 30 Jul 2026 · Tags: SQL injection
- [ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD](https://agentprime.io/advisories/CVE-2026-14355.md)
  `CVE-2026-14355` · CVE record: php php · CVSS 5.6 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Memory corruption
- [DoS attack via DOMNode::C14N()](https://agentprime.io/advisories/CVE-2026-7263.md)
  `CVE-2026-7263` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Denial of service
- [Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding](https://agentprime.io/advisories/CVE-2026-6104.md)
  `CVE-2026-6104` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Memory corruption
- [Out-of-bounds read in urldecode() on NetBSD](https://agentprime.io/advisories/CVE-2026-7258.md)
  `CVE-2026-7258` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Memory corruption
- [Use-After-Free in SOAP using Apache map](https://agentprime.io/advisories/CVE-2026-6722.md)
  `CVE-2026-6722` · CVE record: PHP Group PHP · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 May 2026 · Tags: Memory corruption
- [Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()](https://agentprime.io/advisories/CVE-2026-7259.md)
  `CVE-2026-7259` · CVE record: PHP Group PHP · CVSS 2.1 Low · Not analysed yet · Published 10 May 2026 · Tags: Memory corruption
- [SoapServer session-persisted object use-after-free via SOAP header fault](https://agentprime.io/advisories/CVE-2026-7261.md)
  `CVE-2026-7261` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Memory corruption
- [NULL pointer dereference in SOAP apache:Map decoder with missing \<value>](https://agentprime.io/advisories/CVE-2026-7262.md)
  `CVE-2026-7262` · CVE record: PHP Group PHP · CVSS 2.9 Low · Not analysed yet · Published 10 May 2026 · Tags: Memory corruption
- [SQL injection in pdo_firebird via NUL bytes in quoted strings](https://agentprime.io/advisories/CVE-2025-14179.md)
  `CVE-2025-14179` · CVE record: PHP Group PHP · CVSS 7.4 High · Not analysed yet · Published 10 May 2026 · Tags: SQL injection
- [Signed integer overflow in metaphone()](https://agentprime.io/advisories/CVE-2026-7568.md)
  `CVE-2026-7568` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 10 May 2026 · Tags: Memory corruption
- [XSS within PHP-FPM status endpoint](https://agentprime.io/advisories/CVE-2026-6735.md)
  `CVE-2026-6735` · CVE record: PHP Group PHP · CVSS 7.3 High · Not analysed yet · Published 10 May 2026 · Tags: Cross-site scripting (XSS)
- [Information Leak of Memory in getimagesize](https://agentprime.io/advisories/CVE-2025-14177.md)
  `CVE-2025-14177` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 27 Dec 2025 · Tags: Memory corruption
- [Heap buffer overflow in array_merge()](https://agentprime.io/advisories/CVE-2025-14178.md)
  `CVE-2025-14178` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 27 Dec 2025 · Tags: Memory corruption
- [NULL Pointer Dereference in PDO quoting](https://agentprime.io/advisories/CVE-2025-14180.md)
  `CVE-2025-14180` · CVE record: PHP Group PHP · CVSS 8.2 High · Not analysed yet · Published 27 Dec 2025 · Tags: Memory corruption
- [pgsql extension does not check for errors during escaping](https://agentprime.io/advisories/CVE-2025-1735.md)
  `CVE-2025-1735` · CVE record: PHP Group PHP · CVSS 5.9 Medium · Not analysed yet · Published 13 Jul 2025 · Tags: SQL injection, Memory corruption
- [Null byte termination in hostnames](https://agentprime.io/advisories/CVE-2025-1220.md)
  `CVE-2025-1220` · CVE record: PHP Group PHP · CVSS 3.7 Low · Not analysed yet · Published 13 Jul 2025 · Tags: Server-side request forgery (SSRF)
- [NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix](https://agentprime.io/advisories/CVE-2025-6491.md)
  `CVE-2025-6491` · CVE record: PHP Group PHP · CVSS 5.9 Medium · Not analysed yet · Published 13 Jul 2025 · Tags: Memory corruption
- [Reference counting in php_request_shutdown causes Use-After-Free](https://agentprime.io/advisories/CVE-2024-11235.md)
  `CVE-2024-11235` · CVE record: PHP Group PHP · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Apr 2025 · Tags: Memory corruption
- [Stream HTTP wrapper truncates redirect location to 1024 bytes](https://agentprime.io/advisories/CVE-2025-1861.md)
  `CVE-2025-1861` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 30 Mar 2025 · Tags: Memory corruption
- [Stream HTTP wrapper header check might omit basic auth header](https://agentprime.io/advisories/CVE-2025-1736.md)
  `CVE-2025-1736` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 30 Mar 2025 · Tags: CWE-20
- [Streams HTTP wrapper does not fail for headers with invalid name and no colon](https://agentprime.io/advisories/CVE-2025-1734.md)
  `CVE-2025-1734` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 30 Mar 2025 · Tags: CWE-20
- [libxml streams use wrong content-type header when requesting a redirected resource](https://agentprime.io/advisories/CVE-2025-1219.md)
  `CVE-2025-1219` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 30 Mar 2025 · Tags: CWE-1116
- [Header parser of http stream wrapper does not handle folded headers](https://agentprime.io/advisories/CVE-2025-1217.md)
  `CVE-2025-1217` · CVE record: PHP Group PHP · CVSS 6.3 Medium · Not analysed yet · Published 29 Mar 2025 · Tags: CWE-20
- [PDO::quote() may return unquoted string](https://agentprime.io/advisories/CVE-2022-31631.md)
  `CVE-2022-31631` · CVE record: PHP Group PHP · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Feb 2025 · Tags: Other injection
- [Single byte overread with convert.quoted-printable-decode filter](https://agentprime.io/advisories/CVE-2024-11233.md)
  `CVE-2024-11233` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 24 Nov 2024 · Tags: Memory corruption
- [Configuring a proxy in a stream context might allow for CRLF injection in URIs](https://agentprime.io/advisories/CVE-2024-11234.md)
  `CVE-2024-11234` · CVE record: PHP Group PHP · CVSS 4.8 Medium · Not analysed yet · Published 24 Nov 2024 · Tags: CWE-20
- [Integer overflow in the firebird and dblib quoters causing OOB writes](https://agentprime.io/advisories/CVE-2024-11236.md)
  `CVE-2024-11236` · CVE record: PHP Group PHP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Nov 2024 · Tags: Memory corruption
- [Leak partial content of the heap through heap buffer over-read in mysqlnd](https://agentprime.io/advisories/CVE-2024-8929.md)
  `CVE-2024-8929` · CVE record: PHP Group PHP · CVSS 5.8 Medium · Not analysed yet · Published 22 Nov 2024 · Tags: Memory corruption, Information disclosure
- [OOB access in ldap_escape](https://agentprime.io/advisories/CVE-2024-8932.md)
  `CVE-2024-8932` · CVE record: PHP Group PHP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Nov 2024 · Tags: Memory corruption
- [PHP-FPM logs from children may be altered](https://agentprime.io/advisories/CVE-2024-9026.md)
  `CVE-2024-9026` · CVE record: PHP Group PHP · CVSS 3.3 Low · Not analysed yet · Published 8 Oct 2024 · Tags: Other injection, CWE-158
- [cgi.force_redirect configuration is bypassable due to the environment variable collision](https://agentprime.io/advisories/CVE-2024-8927.md)
  `CVE-2024-8927` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-1220
- [PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)](https://agentprime.io/advisories/CVE-2024-8926.md)
  `CVE-2024-8926` · CVE record: PHP Group PHP · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2024 · Tags: Command injection
- [Erroneous parsing of multipart form data](https://agentprime.io/advisories/CVE-2024-8925.md)
  `CVE-2024-8925` · CVE record: PHP Group PHP · CVSS 3.1 Low · Not analysed yet · Published 8 Oct 2024 · Tags: HTTP request smuggling
- [PHP is vulnerable to the Marvin Attack](https://agentprime.io/advisories/CVE-2024-2408.md)
  `CVE-2024-2408` · CVE record: PHP Group PHP · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2024 · Tags: Information disclosure
- [Argument Injection in PHP-CGI](https://agentprime.io/advisories/CVE-2024-4577.md)
  `CVE-2024-4577` · CVE record: PHP Group PHP · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 1.00 · Not analysed yet · Published 9 Jun 2024 · Tags: Command injection
- [Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)](https://agentprime.io/advisories/CVE-2024-5585.md)
  `CVE-2024-5585` · CVE record: PHP Group PHP · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 9 Jun 2024 · Tags: Command injection, CWE-116
- [Filter bypass in filter_var (FILTER_VALIDATE_URL)](https://agentprime.io/advisories/CVE-2024-5458.md)
  `CVE-2024-5458` · CVE record: PHP Group PHP · CVSS 5.3 Medium · EPSS 0.12 · Not analysed yet · Published 9 Jun 2024 · Tags: CWE-345
- [Command injection via array-ish $command parameter of proc_open()](https://agentprime.io/advisories/CVE-2024-1874.md)
  `CVE-2024-1874` · CVE record: PHP Group PHP · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 29 Apr 2024 · Tags: CWE-116
- [PHP mb_encode_mimeheader runs endlessly for some inputs](https://agentprime.io/advisories/CVE-2024-2757.md)
  `CVE-2024-2757` · CVE record: PHP Group PHP · CVSS 7.5 High · Not analysed yet · Published 29 Apr 2024 · Tags: Denial of service
- [PHP function password_verify can erroneously return true when argument contains NUL](https://agentprime.io/advisories/CVE-2024-3096.md)
  `CVE-2024-3096` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 29 Apr 2024 · Tags: CWE-20
- [\_\_Host-/\_\_Secure- cookie bypass due to partial CVE-2022-31629 fix](https://agentprime.io/advisories/CVE-2024-2756.md)
  `CVE-2024-2756` · CVE record: PHP Group PHP · CVSS 6.5 Medium · EPSS 0.38 · Not analysed yet · Published 29 Apr 2024 · Tags: CWE-20
- [Potential buffer overflow in php_cli_server_startup_workers](https://agentprime.io/advisories/CVE-2022-4900.md)
  `CVE-2022-4900` · CVE record: php and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2023 · Tags: Memory corruption
- [Buffer overflow and overread in phar_dir_read()](https://agentprime.io/advisories/CVE-2023-3824.md)
  `CVE-2023-3824` · CVE record: PHP Group PHP · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 11 Aug 2023 · Tags: Memory corruption
- [Security issue with external entity loading in XML without enabling it](https://agentprime.io/advisories/CVE-2023-3823.md)
  `CVE-2023-3823` · CVE record: PHP Group PHP · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2023

Older: <https://agentprime.io/advisories/technology/php.md?cursor=WyIyMDIzLTA4LTExVDA1OjQyOjI1Ljc3MTAwMFoiLCJDVkUtMjAyMy0zODIzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=php>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/php/>. Everything for agents: <https://agentprime.io/llms.txt>.