# PHP Group PHP vulnerabilities Source: https://junglewise.ai/threats/technologies/php Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/php.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in PHP Group PHP: 0 in the last 7 days and 2 in the last 90 days, 11 of them critical and 5 exploited in the wild. The most recent, CVE-2026-109619, was published on 21 October 2026. 2 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0, 2 exploited in the wild against 0. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 2 - All time: 25 (11 critical, 5 exploited in the wild) ## About PHP Group PHP Server-side scripting language designed for web development and commonly embedded in HTML. ## Latest PHP Group PHP vulnerabilities - [CVE-2026-109619: PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into) (critical, exploited in the wild, published 21 Oct 2026) - [CVE-2026-109618: PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070) (critical, exploited in the wild, published 21 Oct 2026) - [CVE-2026-7260: PHP Phar uncontrolled recursion in phar_get_link_source](https://junglewise.ai/threats/cve-2026-7260-php-phar-uncontrolled-recursion-in-phar-get-link-source) (info, CVSS 5.5, published 30 Jul 2026) - [CVE-2026-17544: PHP BCMath out-of-bounds write in bccomp](https://junglewise.ai/threats/cve-2026-17544-php-bcmath-out-of-bounds-write-in-bccomp) (info, CVSS 8.1, published 30 Jul 2026) - [CVE-2026-17543: PHP ext-pgsql SQL injection in pg_select and related functions](https://junglewise.ai/threats/cve-2026-17543-php-ext-pgsql-sql-injection-in-pg-select-and-related-functions) (info, CVSS 8.1, published 30 Jul 2026) - [CVE-2026-14355: PHP OpenSSL extension heap overflow in AES-WRAP-PAD](https://junglewise.ai/threats/cve-2026-14355-php-openssl-extension-heap-overflow-in-aes-wrap-pad) (medium, CVSS 5.6, published 3 Jul 2026) - [CVE-2026-7263: PHP DOMNode::C14N() denial of service via circular linked list](https://junglewise.ai/threats/cve-2026-7263-php-domnode-c14n-denial-of-service-via-circular-linked-list) (high, CVSS 7.5, published 10 May 2026) - [CVE-2026-6104: PHP mbstring out-of-bounds read in mb_convert_encoding](https://junglewise.ai/threats/cve-2026-6104-php-mbstring-out-of-bounds-read-in-mb-convert-encoding) (critical, CVSS 9.1, published 10 May 2026) - [CVE-2026-7568: PHP signed integer overflow in metaphone function](https://junglewise.ai/threats/cve-2026-7568-php-signed-integer-overflow-in-metaphone-function) (high, CVSS 7.5, published 10 May 2026) - [CVE-2026-7262: PHP SOAP extension NULL pointer dereference in apache:Map decoder](https://junglewise.ai/threats/cve-2026-7262-php-soap-extension-null-pointer-dereference-in-apache-map-decoder) (high, CVSS 7.5, published 10 May 2026) - [CVE-2026-7261: PHP SoapServer use-after-free in SOAP_PERSISTENCE_SESSION](https://junglewise.ai/threats/cve-2026-7261-php-soapserver-use-after-free-in-soap-persistence-session) (critical, CVSS 9.8, published 10 May 2026) - [CVE-2026-7259: PHP mbstring NULL pointer dereference in mb_regex_encoding](https://junglewise.ai/threats/cve-2026-7259-php-mbstring-null-pointer-dereference-in-mb-regex-encoding) (medium, CVSS 6.5, published 10 May 2026) - [CVE-2026-7258: PHP out-of-bounds read in urldecode leading to denial of service](https://junglewise.ai/threats/cve-2026-7258-php-out-of-bounds-read-in-urldecode-leading-to-denial-of-service) (high, CVSS 7.5, published 10 May 2026) - [CVE-2026-6722: PHP SOAP extension use-after-free remote code execution](https://junglewise.ai/threats/cve-2026-6722-php-soap-extension-use-after-free-remote-code-execution) (critical, CVSS 9.8, published 10 May 2026) - [CVE-2025-14179: PHP PDO Firebird SQL injection via NUL bytes in quoted strings](https://junglewise.ai/threats/cve-2025-14179-php-pdo-firebird-sql-injection-via-nul-bytes-in-quoted-strings) (critical, CVSS 9.8, published 10 May 2026) - [CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability](https://junglewise.ai/threats/cve-2024-4577-php-cgi-os-command-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 12 Jun 2024) - [CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability](https://junglewise.ai/threats/cve-2012-1823-php-cgi-query-string-parameter-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2022) - [CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2019-11043-php-fastcgi-process-manager-fpm-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2022) - [CVE-2016-10162: PHP WDDX NULL pointer dereference in php_wddx_pop_element](https://junglewise.ai/threats/cve-2016-10162-php-wddx-null-pointer-dereference-in-php-wddx-pop-element) (high, CVSS 7.5, published 24 Jan 2017) - [CVE-2016-10161: PHP out-of-bounds read in var_unserializer.c](https://junglewise.ai/threats/cve-2016-10161-php-out-of-bounds-read-in-var-unserializer-c) (high, CVSS 7.5, published 24 Jan 2017) - [CVE-2016-10160: PHP off-by-one error in phar_parse_pharfile](https://junglewise.ai/threats/cve-2016-10160-php-off-by-one-error-in-phar-parse-pharfile) (critical, CVSS 9.8, published 24 Jan 2017) - [CVE-2016-10159: PHP integer overflow in phar_parse_pharfile](https://junglewise.ai/threats/cve-2016-10159-php-integer-overflow-in-phar-parse-pharfile) (high, CVSS 7.5, published 24 Jan 2017) - [CVE-2016-10158: PHP EXIF denial of service in exif_convert_any_to_int](https://junglewise.ai/threats/cve-2016-10158-php-exif-denial-of-service-in-exif-convert-any-to-int) (high, CVSS 7.5, published 24 Jan 2017) - [CVE-1999-0238: PHP php.cgi arbitrary file disclosure](https://junglewise.ai/threats/cve-1999-0238-php-php-cgi-arbitrary-file-disclosure) (critical, CVSS 10, published 1 Aug 1997) - [CVE-1999-0058: PHP php.cgi buffer overflow allows shell access](https://junglewise.ai/threats/cve-1999-0058-php-php-cgi-buffer-overflow-allows-shell-access) (high, CVSS 7.5, published 17 Apr 1997) ## Most severe PHP Group PHP vulnerabilities - [CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability](https://junglewise.ai/threats/cve-2024-4577-php-cgi-os-command-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 12 Jun 2024) - [CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2019-11043-php-fastcgi-process-manager-fpm-buffer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2022) - [CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability](https://junglewise.ai/threats/cve-2012-1823-php-cgi-query-string-parameter-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 25 Mar 2022) - [CVE-2026-109619: PHP use-after-free in global state handling](https://junglewise.ai/threats/cve-2026-109619-php-has-various-global-state-that-temporarily-points-into) (critical, exploited in the wild, published 21 Oct 2026) - [CVE-2026-109618: PHP Memory Corruption Vulnerability](https://junglewise.ai/threats/cve-2026-109618-gcp-2026-070) (critical, exploited in the wild, published 21 Oct 2026) - [CVE-1999-0238: PHP php.cgi arbitrary file disclosure](https://junglewise.ai/threats/cve-1999-0238-php-php-cgi-arbitrary-file-disclosure) (critical, CVSS 10, published 1 Aug 1997) - [CVE-2026-6722: PHP SOAP extension use-after-free remote code execution](https://junglewise.ai/threats/cve-2026-6722-php-soap-extension-use-after-free-remote-code-execution) (critical, CVSS 9.8, published 10 May 2026) - [CVE-2026-7261: PHP SoapServer use-after-free in SOAP_PERSISTENCE_SESSION](https://junglewise.ai/threats/cve-2026-7261-php-soapserver-use-after-free-in-soap-persistence-session) (critical, CVSS 9.8, published 10 May 2026) - [CVE-2025-14179: PHP PDO Firebird SQL injection via NUL bytes in quoted strings](https://junglewise.ai/threats/cve-2025-14179-php-pdo-firebird-sql-injection-via-nul-bytes-in-quoted-strings) (critical, CVSS 9.8, published 10 May 2026) - [CVE-2016-10160: PHP off-by-one error in phar_parse_pharfile](https://junglewise.ai/threats/cve-2016-10160-php-off-by-one-error-in-phar-parse-pharfile) (critical, CVSS 9.8, published 24 Jan 2017) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up from none in the four before. 2 critical against 0, 2 exploited in the wild against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 2 | 2 | 2 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "PHP Group PHP vulnerabilities", https://junglewise.ai/threats/technologies/php, 9 November 2026.