PHP Group
3 CVEs in CISA KEV — 1 with confirmed ransomware use
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2026-109618 |
PHP | 9.2 | 1.0000 | 2026-10-26 | 2026-10-29 | 710 PoC | PHP contains an out-of-memory corruption vulnerability that allows for unauthent |
CVE-2026-109619 |
PHP | 9.2 | 1.0000 | 2026-10-26 | 2026-10-29 | PHP contains a stale internal request-state vulnerability that allows for unauth | |
CVE-2024-4577 |
PHP | — | 0.9999 | 2024-06-12 | 2024-07-03 | RW | PHP, specifically Windows-based PHP used in CGI mode, contains an OS command inj |