PHP
- Software type
- Programming language
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/22/2026, PHP recorded 16 security vulnerabilities in the last 90 days, of which 5 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of PHP and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-109619RCE via stale global stateCVE-2026-109618RCE via OOM corruptionCVE-2026-92842OOB read / info leak in convert.* stream filters when line-break-chars contains NULCVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN Mismatch| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-109619RCE via stale global state | Exploitation statusNot exploited | FixYes |
| SeverityCritical |
CVE-2026-109618RCE via OOM corruption | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityCritical |
|---|
CVE-2026-92842OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN Mismatch | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-91767Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2025-1218Various packet overreads in mysqlnd_writeprotocol.c | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityLow |
|---|
CVE-2026-91766Cross-origin credential leak in HTTP stream wrapper redirects | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-91765SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | Exploitation statusNot exploited | FixYes | Published09/25/2026 | SeverityHigh |
|---|
CVE-2025-14181Integer overflow to buffer overflow in soap HTTP parsing | Exploitation statusActively exploited | FixYes | Published09/25/2026 | SeverityMedium |
|---|
103 Results | Page 1 of 11