PatchSiren

php CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH php CVE published 2026-06-10

CVE-2026-45062

CVE-2026-45062 is a high-severity vulnerability in FrankenPHP, a modern application server for PHP. The vulnerability allows an attacker to mislead FrankenPHP into treating a non-.php file as a .php script, potentially leading to remote code execution. The issue was patched in version 1.12.3.

Known exploited PHP CVE published 2025-07-07

CVE-2016-10033

CVE-2016-10033 is a command injection vulnerability in PHPMailer, an open-source PHP mail component. CISA lists it in the Known Exploited Vulnerabilities (KEV) catalog, which means affected environments should treat it as a high-priority remediation item. The supplied CISA metadata sets the mitigation due date to 2025-07-28.

Known exploited PHP CVE published 2022-03-25

CVE-2019-11043

CVE-2019-11043 is listed by CISA in the Known Exploited Vulnerabilities catalog as a PHP FastCGI Process Manager (FPM) buffer overflow vulnerability. The supplied record marks it as known exploited and notes known ransomware campaign use. Organizations running PHP FPM should treat this as a high-priority remediation item and follow vendor guidance to apply updates and verify exposure has been removed.

Known exploited PHP CVE published 2022-03-25

CVE-2012-1823

CVE-2012-1823 is a PHP CGI query string parameter vulnerability that CISA lists in the Known Exploited Vulnerabilities catalog. For defenders, the key takeaway is that this issue is treated as actively exploited and should be prioritized for remediation using vendor guidance. The provided corpus is limited, so this debrief focuses on the official KEV status and the vendor/product identification rather tha [truncated]

HIGH PHP CVE published 2017-03-02

CVE-2015-8994

CVE-2015-8994 affects PHP 5.x and 7.x deployments that use apache2handler/mod_php or php-fpm with OpCache enabled. In the affected configurations, shared OpCache state in a parent process could let child processes reuse cached script bytecode across user boundaries, weakening the protection normally provided by file permissions. The risk is highest in shared-hosting or privilege-separation setups where di [truncated]

HIGH PHP CVE published 2017-02-01

CVE-2017-5630

CVE-2017-5630 affects PEAR Base System 1.10.1 in the Installer download utility class used by PECL. According to the NVD record, the flaw is that file types and filenames are not validated after a redirect, which can let a remote HTTP server cause unintended file overwrites via crafted responses. The published references indicate impact to integrity, including a demonstrated .htaccess overwrite.

HIGH PHP CVE published 2017-01-24

CVE-2016-10162

CVE-2016-10162 is a remotely triggerable denial-of-service issue in PHP's WDDX deserialization path. A crafted wddxPacket XML document with an inapplicable class name can cause mishandling in wddx_deserialize, leading to a NULL pointer dereference and application crash. NVD rates the issue CVSS 7.5 (High) because it is network-reachable, requires no privileges or user interaction, and impacts availability.

HIGH PHP CVE published 2017-01-24

CVE-2016-10161

CVE-2016-10161 is a PHP denial-of-service issue in the unserialization path. Crafted serialized data can trigger a buffer over-read in object_common1/finish_nested_data, causing the application to crash. The issue affects PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1.

CRITICAL PHP CVE published 2017-01-24

CVE-2016-10160

CVE-2016-10160 is a critical memory-corruption bug in PHP’s PHAR archive parser. A crafted PHAR archive with an alias mismatch can trigger an off-by-one error in phar_parse_pharfile(), potentially causing a denial of service and, according to the CVE description, possibly arbitrary code execution. The NVD record ties the issue to PHP releases prior to 5.6.30 and 7.0.15, and also lists PHP 7.1.0 as vulnerable.

HIGH PHP CVE published 2017-01-24

CVE-2016-10159

CVE-2016-10159 is a PHP PHAR parsing vulnerability that can be triggered by a truncated manifest entry in a PHAR archive. The result is a denial of service through excessive memory consumption or an application crash; the NVD CVSS vector rates this as network-exploitable, unauthenticated, and availability-only.

HIGH PHP CVE published 2017-01-24

CVE-2016-10158

CVE-2016-10158 is a PHP EXIF parsing flaw that can crash affected applications when they process specially crafted EXIF metadata. The impact is denial of service only, but the NVD assigns a HIGH severity score because the issue is reachable over the network, requires no privileges or user interaction, and affects availability.

CRITICAL PHP CVE published 2017-01-23

CVE-2016-5873

CVE-2016-5873 is a critical memory-corruption issue in the pecl_http HTTP URL parsing functions. A remote attacker can trigger a buffer overflow by supplying crafted URLs containing non-printable characters, which can lead to arbitrary code execution on affected systems.