# CVE-2026-24765: PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Source: https://junglewise.ai/threats/cve-2026-24765-phpunit-vulnerable-to-unsafe-deserialization-in-phpt-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-27. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-24765 · Severity: high · CVSS 7.8 · Published 2026-01-27

### Overview

A vulnerability has been discovered involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test.

### Technical Details

**Affected Component:** PHPT test runner, method `cleanupForCoverage()`
**Affected Versions:** <= 8.5.51, <= 9.6.32, <= 10.5.61, <= 11.5.49, <= 12.5.7

### Vulnerable Code Pattern

```php
if ($buffer !== false) {
    // Unsafe call without restrictions
    $coverage = @unserialize($buffer);
}
```

The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled.

### Attack Prerequisites and Constraints

This vulnerability requires **local file write access** to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through:

* **CI/CD Pipeline Attacks:** A malicious pull request that places a `.coverage` file alongside test files, executed when the CI system runs tests using PHPUnit and collects code coverage information
* **Local Development Environment:** An attacker with shell access or ability to write files to the project directory
* **Compromised Dependencies:** A supply chain attack inserting malicious files into a package or monorepo

**Critical Context:** Running test suites from unreviewed pull requests without isolated execution is inherently a code execution risk, independent of this specific vulnerability. This represents a broader class of [Poisoned Pipeline Execution (PPE) attacks](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution) affecting CI/CD systems.

### Proposed Remediation Approach

Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition.

#### Rationale for Error-Based Approach:

1. **Visibility Over Silence:** When an invariant is violated (a `.coverage` file existing before test execution), the error must be visible in CI/CD output, alerting operators to investigate the root cause rather than proceeding with sanitized input
2. **Operational Security:** A `.coverage` file should never exist before tests run, coverage data is generated by executing tests, not sourced from artifacts. Its presence indicates:
    * A malicious actor placed it intentionally
    * Build artifacts from a previous run contaminated the environment
    * An unexpected filesystem state requiring investigation
3. **Defense-in-Depth Principle:** Protecting a single deserialization call does not address the fundamental attack surface. Proper mitigations for PPE attacks lie outside PHPUnit's scope:
    * Isolate CI/CD runners (ephemeral, containerized environments)
    * Restrict code execution on protected branches
    * Scan pull requests and artifacts for tampering
    * Use branch protection rules to prevent unreviewed code execution

### Severity Classification

* **Attack Vector (AV):** Local (L) — requires write access to the file system where tests execute
* **Attack Complexity (AC):** Low (L) — exploitation is straightforward once the malicious file is placed
* **Privileges Required (PR):** Low (L) — PR submitter status or contributor role provides sufficient access
* **User Interaction (UI):** None (N) — automatic execution during standard test execution
* **Scope (S):** Unchanged (U) — impact remains within the affected test execution context
* **Confidentiality Impact (C):** High (H) — full remote code execution enables complete system compromise
* **Integrity Impact (I):** High (H) — arbitrary code execution allows malicious modifications
* **Availability Impact (A):** High (H) — full code execution permits denial-of-service actions

### Mitigating Factors (Environmental Context)

Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration:

* **Ephemeral Runners:** Use containerized, single-use CI/CD runners that discard filesystem state between runs
* **Code Review Enforcement:** Require human review and approval before executing code from pull requests
* **Branch Protection:** Enforce branch protection rules that block unreviewed code execution
* **Artifact Isolation:** Separate build artifacts from source; never reuse artifacts across independent builds
* **Access Control:** Limit file write permissions in CI environments to authenticated, trusted actors

### Fixed Behaviour

When a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. This ensures:

* **Visibility:** The error appears prominently in CI/CD output and test logs
* **Investigation:** Operations teams can investigate the root cause (potential tampering, environment contamination)
* **Fail-Fast Semantics:** Test execution stops rather than proceeding with an unexpected state

### Recommendation

**Update to the patched version immediately** if a project runs PHPT tests using PHPUnit with coverage instrumentation in any CI/CD environment that executes code from external contributors. Additionally, audit the project's CI/CD configuration to ensure:

* Pull requests from forks or untrusted sources execute in isolated environments
* Branch protection rules require human review before code execution
* CI/CD runners are ephemeral and discarded after each build
* Build artifacts are not reused across independent runs without validation

Technologies: [phpunit/phpunit (Packagist)](https://junglewise.ai/threats/technologies/phpunit-phpunit). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-24765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-24765 being exploited in the wild.

**How severe is CVE-2026-24765?** High severity, with a CVSS score of 7.8, published 27 January 2026.

**Which products and versions are affected?** phpunit/phpunit (Packagist) ECOSYSTEM:introduced=0,fixed=8.5.52.

**Is there a fix for CVE-2026-24765?** Yes. phpunit/phpunit (Packagist): upgrade to 8.5.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-24765?** Check whether you run phpunit/phpunit (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpunit/phpunit (Packagist): upgrade to 8.5.52 or later

  ```sh
  composer require phpunit/phpunit:^8.5.52
  ```


## Affected products

- phpunit/phpunit (Packagist) ECOSYSTEM:introduced=0,fixed=8.5.52

## Identifiers

- CVE-2026-24765
- GHSA-vvj3-c3rp-c85p

## References

- [https://api.github.com/users/aqhmal](https://api.github.com/users/aqhmal)
- [https://github.com/aqhmal](https://github.com/aqhmal)
- [https://api.github.com/users/aqhmal/gists%7B/gist_id%7D](https://api.github.com/users/aqhmal/gists%7B/gist_id%7D)
- [https://api.github.com/users/aqhmal/repos](https://api.github.com/users/aqhmal/repos)
- [https://avatars.githubusercontent.com/u/22043590?v=4](https://avatars.githubusercontent.com/u/22043590?v=4)
- [https://api.github.com/users/aqhmal/events%7B/privacy%7D](https://api.github.com/users/aqhmal/events%7B/privacy%7D)

## Related threats

- [PHPUnit predictable temp directory in code coverage for PHPT tests](https://junglewise.ai/threats/cve-2026-119193-phpunit-is-a-testing-framework-for-php-from-13-4-0-until-13-4-4)
- [PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes](https://junglewise.ai/threats/cve-2026-41570-phpunit-has-argument-injection-via-newline-in-php-ini-values-that)
- [Code Injection in PHPUnit](https://junglewise.ai/threats/cve-2017-9841-phpunit-command-injection-vulnerability)