PatchPHP

PHP security advisories

Critical vulnerabilities in the PHP runtime itself, the configurations they affect and the releases that fix them. Each entry links to the official advisory and the NVD record.

Reviewed 22 October 2026 against php.net, NVD, GitHub php-src advisories and the CISA Known Exploited Vulnerabilities catalog.

  1. PHP2Shell

    Critical

    CVE-2026-109618, CVE-2026-109619

    Two vulnerabilities allow unauthenticated remote code execution on PHP installations that serve web requests.

    Affected configuration: All PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers the risk highest for mod_php.

    What to check and sources
    Published
    21 October 2026
    Added to CISA KEV
    Not listed
    PHP 8.5
    8.5.12
    PHP 8.4
    8.4.27
    PHP 8.3
    8.3.36
    PHP 8.2
    8.2.35
    PHP 7.4, 8.0, 8.1
    Source backport only

  2. PHP-CGI argument injection on Windows

    Critical

    CVE-2024-4577

    Windows “Best-Fit” character conversion lets an attacker pass options to the PHP binary, which can reveal source code or run arbitrary PHP code.

    Affected configuration: PHP running as PHP-CGI behind Apache on Windows, when the system uses certain code pages. NVD lists the 8.1, 8.2 and 8.3 branches; earlier branches were already end of life.

    What to check and sources
    Published
    9 June 2024
    Added to CISA KEV
    12 June 2024
    PHP 8.3
    8.3.8
    PHP 8.2
    8.2.20
    PHP 8.1
    8.1.29

  3. PHP-FPM buffer underflow

    Critical

    CVE-2019-11043

    In certain PHP-FPM configurations, the FPM module can write past allocated buffers into space reserved for FastCGI protocol data, opening the possibility of remote code execution.

    Affected configuration: Certain PHP-FPM setups on the 7.1, 7.2 and 7.3 branches. Public exploitation targeted nginx configurations that pass PATH_INFO using fastcgi_split_path_info.

    What to check and sources
    Published
    28 October 2019
    Added to CISA KEV
    25 March 2022
    PHP 7.3
    7.3.11
    PHP 7.2
    7.2.24
    PHP 7.1
    7.1.33

  4. php-cgi query string injection

    Critical

    CVE-2012-1823

    When PHP runs as a CGI script, a query string without an equals sign can be read as command-line options, allowing remote code execution.

    Affected configuration: PHP configured as php-cgi, before 5.3.12 and 5.4.x before 5.4.2. CVE-2024-4577 later bypassed the protection added for this issue on Windows.

    What to check and sources
    Published
    11 May 2012
    Added to CISA KEV
    25 March 2022
    PHP 5.4
    5.4.2
    PHP 5.3
    5.3.12

This is not a complete list of PHP vulnerabilities. It covers runtime flaws that allow remote code execution and that we check for during an assessment. For every PHP security fix, see the PHP 8 changelog and the php-src security advisories. CISA KEV status was checked against catalog version 2026.10.21.