Is PHP safe right now?
2 flaws were added to CISA's list of actively exploited vulnerabilities in the last 30 days, including zero-days. If you run PHP, update now.
Exploited in the last 90 days
- PHPZero-dayTwo PHP flaws let attackers take over web servers with no login
What to do: Upgrade PHP. If a hosting company runs your site, ask them to confirm they've updated. Check for updates to any software or appliance that bundles PHP.
Fixed in: PHP 8.5.12; 8.4.27; 8.3.36
- PHPZero-dayTwo PHP flaws let attackers take over web servers with no login
What to do: Upgrade PHP. If a hosting company runs your site, ask them to confirm they've updated. Check for updates to any software or appliance that bundles PHP.
Fixed in: PHP 8.5.12; 8.4.27; 8.3.36
Earlier exploited flaws
- PHPMailer Command Injection Vulnerability
- PHP-CGI OS Command Injection Vulnerability Zero-day
- PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
- PHP-CGI Query String Parameter Vulnerability
- phpMyAdmin Remote Code Execution Vulnerability
- PHPUnit Command Injection Vulnerability
- ThinkPHP Remote Code Execution Vulnerability
- ThinkPHP "noneCms" Remote Code Execution Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 2 | 2 |
| 2025 | 1 | 0 |
| 2024 | 1 | 1 |
| 2023 | 0 | 0 |
| 2022 | 4 | 0 |
Questions
Is PHP safe right now?
2 flaws were added to CISA's list of actively exploited vulnerabilities in the last 30 days, including zero-days. If you run PHP, update now. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many PHP vulnerabilities have been exploited?
10 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 2 of them used by ransomware.
Covers products matching php. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.