PatchTheCEVphp vulnerabilities
Recent CVEs affecting php products. 13 tracked.
php has 13 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-10-21. Highest priority: CVE-2026-109618 (score 71/100).
- CVE-2026-17544 CRITICAL 9.8 UPGRADE Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PH
- CVE-2026-17543 CRITICAL 9.8 UPGRADE Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP
- CVE-2026-7260 MEDIUM 5.5 UPGRADE Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashin
- CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
- CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
- CVE-2026-93682 MEDIUM 5.8 UPGRADE When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value
- CVE-2025-14181 MEDIUM 6.5 UPGRADE The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, wh
- CVE-2025-1218 LOW 3.4 UPGRADE The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still hold
- CVE-2026-17545 HIGH 7.5 UPGRADE On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, C
- CVE-2026-6103 MEDIUM 4.3 UPGRADE phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
- CVE-2026-91765 HIGH 7.5 UPGRADE cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
- CVE-2026-91766 MEDIUM 5.9 UPGRADE When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Pro
- CVE-2026-91769 MEDIUM 4.3 UPGRADE PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no
FAQ
How do I fix php vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is php being exploited right now?
None of the tracked php CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which php CVE should I patch first?
CVE-2026-109618 currently ranks highest (71/100): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques.