PHP Group has 13 CVEs on record. Disclosure cadence is accelerating: 13 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 11. The median CVSS is 6.5 (medium), with 2 rated critical. 15% have been exploited in the wild — well above the 1% corpus average, so PHP Group flaws are worth patching on sight. The dominant weakness classes are CWE-125 (4) and CWE-122 (3). Most affected products: ext-standard (3), PHP (2), ext-openssl (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 15% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —(2)
- Last 90 days
- 13 prev 0
Weakness classes
Products
- ext-standard 3
- PHP 2
- ext-openssl 2
- ext-soap 2
- php-src 2
- PHP-FPM 1
Worst active — by depth score
CVE-2026-109619Critical· 9.2RCE via stale global state96CVE-2026-109618Critical· 9.2RCE via OOM corruption96CVE-2026-17545Medium· 6.9On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path50CVE-2025-14181Medium· 6.5The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger48CVE-2026-93682Medium· 5.8When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location44
PHP Group vulnerabilities
CVEs affecting PHP Group, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-109619Critical· 9.2CISA KEVPoCRCE via stale global state
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after i…
CVE-2026-109618Critical· 9.2CISA KEVPoCRCE via OOM corruption
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performin…
CVE-2026-92842Medium· 5.9The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate t…
CVE-2026-91768Medium· 6.5The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing …
CVE-2026-91769Medium· 4.3PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service …
CVE-2026-91767Medium· 6.5php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being ver…
php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being ver…
CVE-2026-91766Medium· 5.9When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HT…
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HT…
CVE-2026-91765High· 7.5cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust th…
CVE-2026-6103Medium· 4.3PoCphar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips …
CVE-2026-17545Medium· 6.9PoCOn Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename theref…
CVE-2025-1218Low· 3.4The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the …
CVE-2025-14181Medium· 6.5PoCThe SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make…
CVE-2026-93682Medium· 5.8PoCWhen the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location
When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte d…