PHP — Hypertext Preprocessor
The PHP Group · php-src on GitHub · security@php.net
8.4.14 · active8.3.14 · active8.2.20 · security only8.1.31 · security only7.4.33 · EOL
| Incident | Branches | Status | EPSS | CVSS | Disclosed |
|---|---|---|---|---|---|
| PHP2Shell PHP-CGI argument injection to remote code execution | 8.3, 8.2, 8.1, 7.4 | ExploitedCISA KEVPatch available | 94.2% | 9.8 Critical | Oct 21, 2026 |
| CVE-2019-11043 PHP-FPM env_path_info underflow (nginx misconfig) | 7.4 | ExploitedCISA KEVPatch available | 97.2% | 9.8 Critical | Oct 22, 2019 |
| CVE-2024-2961 PHP iconv() glibc buffer overflow (CNEXT) | 8.3, 8.2, 8.1 | ExploitedPatch available | 91.2% | 8.8 High | Apr 17, 2024 |
| CVE-2025-21430 PHP 7.4 session upload progress deserialization | 7.4 | EOL | 12.2% | 8.1 High | Jun 2, 2025 |
| CVE-2026-101877 PHP mb_strcut heap over-read | 8.3, 8.2 | Workaround only | 1.1% | 5.3 Medium | Sep 30, 2026 |