pwned.coffeeUpdated 4 min ago

The menu

PHP

Partial outage

1 live incident affecting PHP, 1 not fully patched.

Today's specials

  1. highno fix yetexploited Plex Media Server External Control of File Name or Path Vulnerability Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. Can be chained with CVE-2026-96655, CVE-2026-96654, CVE-2026-96652. Added to CISA KEV on 2026-10-20 (federal deadline 2026-10-23). CVE-2026-96652CVE-2026-96654+26 sources

0 spills in 2025 for PHP

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. criticalpatched FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider fof/oauth (composer) ### Impact An unauthenticated account takeover vulnerability exists in `fof/oauth` when the Discord OAuth provider is enabled. Discord allows an account to use an unverified email address when its phone number has been verified. During OAuth authentication, Discord may return that email address with `"verified": false`. Affected versions of `fof/oauth`… fixed in fof/oauth 1.7.4 +1CVE-2026-921615 sources
  2. highpatchedexploited WordPress Core Remote File Inclusion Vulnerability WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-879022 sources
  3. highpatchedexploited iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability iCagenda iCagenda iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. Added to CISA KEV on 2026-07-10 (federal deadline 2026-07-13). CVE-2026-489392 sources
  4. highpatchedexploited JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. Added to CISA KEV on 2026-07-07 (federal deadline 2026-07-10). CVE-2026-489082 sources
  5. highpatchedexploited Widget Factory Joomla Content Editor Improper Access Control Vulnerability Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. Added to CISA KEV on 2026-06-16 (federal deadline 2026-06-19). CVE-2026-489073 sources
  6. highpatchedexploited Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability Mirasvit Mirasvit Full Page Cache Warmer Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Added to CISA KEV on 2026-06-03 (federal deadline 2026-06-06). CVE-2026-452472 sources
  7. highpatchedexploited RoundCube Webmail Deserialization of Untrusted Data Vulnerability RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. Can be chained with CVE-2025-68461. Added to CISA KEV on 2026-02-20 (federal deadline 2026-03-13). CVE-2025-49113CVE-2025-684617 sources
  8. highpatchedexploited Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability Synacor Zimbra Collaboration Suite (ZCS) contains a PHP remote file inclusion vulnerability that could allow for remote attackers to craft requests to the /h/rest endpoint to influence internal request dispatching, allowing inclusion of arbitrary files from the WebRoot directory. Added to CISA KEV on 2026-01-22 (federal deadline 2026-02-12). CVE-2025-686452 sources

More in Web & runtimes

Follow PHP

RSS: /feed.xml?stack=php. JSON: /incidents.json?stack=php. Or add it to your usual for delivery.