CVE-2025-21430
Last verified 2h agoPHP 7.4 session upload progress deserialization
Exploited in the wild?
Public exploit?
Patch available?
Severity
Risk signals
Known exploited
Not in KEV
EPSS probability
88th percentile
PoC repos
2
CVSS
8.1
Summary
No upstream fix for EOL 7.4; only paid ELTS backports exist.
Fix it
Per-distro commands are being verified
Our team is confirming fixed package versions for PHP. Use your distribution's security tracker in the meantime.
Related incidents
Log4Shell
10.0 CriticalCVE-2021-44228
Still the most-scanned bug on the internet. Embedded Log4j in vendor appliances keeps it alive.
CISA KEVPatch available
Apache Traversal
9.8 CriticalCVE-2021-41773
Encoded dot segments escape DocumentRoot; with mod_cgi enabled, leads to RCE.
CISA KEVPatch available
CVE-2019-11043
9.8 CriticalCVE-2019-11043
Specific nginx fastcgi_split_path_info configs allow RCE in PHP-FPM.
CISA KEVPatch available