CVE-2026-65954 PHPCSStandards CVE debrief

Who should care

Defenders responsible for PHP_CodeSniffer and PHPCSUtils deployments should assess exposure and prioritize updates to mitigate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who use PHPCSUtils in their environments.

Why it matters

Defenders should prioritize updating PHPCSUtils to version 1.2.3 or later to mitigate remote code execution vulnerability.

• Remote code execution on the scanning host
• Potential for arbitrary command execution
• Need for immediate update to version 1.2.3 or later

Technical summary

The AbstractArrayDeclarationSniff::getActualArrayKey() method in PHPCSUtils evaluates attacker-controlled array-key expressions with eval(), allowing callback-form keys in untrusted PHP code scanned by an extending sniff to execute arbitrary commands on the scanning host. This issue affects versions from 1.0.0-alpha1 to 1.2.2 and is fixed in version 1.2.3. Defenders should prioritize updating PHPCSUtils to version 1.2.3 or later to mitigate this vulnerability. The vulnerability allows for remote code execution on the scanning host and potential for arbitrary command execution.

Defensive priority

Defenders should prioritize updating PHPCSUtils to version 1.2.3 or later to mitigate this vulnerability.

Recommended defensive actions

• Update PHPCSUtils to version 1.2.3 or later
• Review and update any extending sniffs that use AbstractArrayDeclarationSniff
• Monitor for any suspicious activity related to PHP_CodeSniffer
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The issue is reachable via Universal.Arrays.DuplicateArrayKey and Universal.Arrays.MixedArrayKeyTypes. There is no indication of exploitation in the wild, but defenders should verify the vulnerability's impact on their deployments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.