en
The PHP Group is the open-source project community and maintainer organization for PHP, a general-purpose scripting language primarily used for server-side web development. It develops and publishes the PHP language, core runtime, extensions, documentation, and releases for developers and organizations worldwide.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/23/2026, PHP Group recorded 16 security vulnerabilities in the last 90 days across 1 products, including 5 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, PHP had the most security vulnerabilities in the PHP Group ecosystem, with 16 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CVE-2026-109619RCE via stale global stateCVE-2026-109618RCE via OOM corruptionCVE-2026-92842OOB read / info leak in convert.* stream filters when line-break-chars contains NULCVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN Mismatch| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-109619RCE via stale global state | Exploitation statusNot exploited | FixYes | Affected productPHP | Published10/21/2026 | SeverityCritical |
CVE-2026-109618RCE via OOM corruption | Exploitation statusNot exploited | FixYes | Affected productPHP | Published10/21/2026 | |
CVE-2026-92842OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | Exploitation statusNot exploited | FixYes | Affected productPHP | Published | |
CVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) | Exploitation statusNot exploited | FixYes | Affected productPHP | Published | |
CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN Mismatch | Exploitation statusNot exploited | FixYes | Affected productPHP | Published09/25/2026 | |
CVE-2026-91767Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | Exploitation statusNot exploited | FixYes | Affected productPHP | Published | |
CVE-2025-1218Various packet overreads in mysqlnd_writeprotocol.c | Exploitation statusNot exploited | FixYes | Affected productPHP | Published09/25/2026 | |
CVE-2026-91766Cross-origin credential leak in HTTP stream wrapper redirects | Exploitation statusNot exploited | FixYes | Affected productPHP | Published09/25/2026 | |
CVE-2026-91765SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | Exploitation statusNot exploited | FixYes | Affected productPHP | Published09/25/2026 | |
CVE-2025-14181Integer overflow to buffer overflow in soap HTTP parsing | Exploitation statusActively exploited | FixYes | Affected productPHP | Published09/25/2026 |
104 Results | Page 1 of 11
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityMedium |
| SeverityLow |
| SeverityMedium |
| SeverityHigh |
| SeverityMedium |