Vendor
PHP
6 of 8 PHP CVEs in Patchfirst (75%) are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it. of vulnerabilities exploited in the wild, 2 of them used by ransomware.
- CVEs
- 8
- In CISA KEV
- 675%
- Known ransomware use
- 2
- Median days to KEV
- 442
- from publication
- Latest KEV listing
- 26 Oct 2026
Products
In KEVOther CVEs
- PHP In KEV: 4 CVEs: 6
- FastCGI Process Manager (FPM) In KEV: 1 CVEs: 1
- PHPMailer In KEV: 1 CVEs: 1
Top ATT&CK techniques
What attackers do with PHP CVEs- T1190Exploit Public-Facing Application CVEs: 6
- T1059Command and Scripting Interpreter CVEs: 5
- T1003OS Credential Dumping CVEs: 1
- T1003.001LSASS Memory CVEs: 1
- T1033System Owner/User Discovery CVEs: 1
Counts are PHP CVEs linked to the technique. Each link’s provenance is on the CVE page.
PHP CVEs
8 CVEs, by priority- CVE-2026-109618PHP Memory Corruption VulnerabilityPHP Group · PHPKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter>99.9%Top 0.01%79.9priority
- CVE-2024-4577PHP-CGI OS Command Injection VulnerabilityPHP Group · PHPKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+10 more>99.9%Top 0.02%79.9priority
- CVE-2019-11043PHP FastCGI Process Manager (FPM) Buffer Overflow VulnerabilityPHP · FastCGI Process Manager (FPM)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter99.8%Top 0.04%79.9priority
- CVE-2026-109619PHP Stale Internal Request-State VulnerabilityPHP Group · PHPKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter>99.9%Top 0.01%78.7priority
- CVE-2023-3824Buffer overflow and overread in phar_dir_read()PHP Group · PHPPublic exploitCritical · 9.421.8%Top 2.4%77.9priority
- CVE-2016-10033PHPMailer Command Injection VulnerabilityPHP · PHPMailerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell99.7%Top 0.05%69.9priority
- CVE-2012-1823PHP-CGI Query String Parameter VulnerabilityPHP · PHPKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter>99.9%Top 0.01%69.9priority
- CVE-2022-31626mysqlnd/pdo password buffer overflowPHP Group · PHPPublic exploitHigh · 7.558.1%Top 0.91%30.1priority