Проверьте свою версию
php -r 'echo PHP_VERSION;'Затронутые ветки версий
- 8.5 CVE: 30 KEV 2
- 8.4 CVE: 39 KEV 2
- 8.3 CVE: 53 KEV 3
- 8.2 CVE: 58 KEV 3
- 8.1 CVE: 45 KEV 3 Окончание поддержки
- 8.0 CVE: 29 KEV 2 Окончание поддержки
- 7.4 CVE: 41 KEV 2 Окончание поддержки
- 7.3 CVE: 60 KEV 3 Окончание поддержки
- 7.2 CVE: 64 KEV 2 Окончание поддержки
- 7.1 CVE: 79 KEV 2 Окончание поддержки
- 7.0 CVE: 151 KEV 1 Окончание поддержки
- 6.0 CVE: 18 KEV 1
- 5.6 CVE: 215 KEV 1 Окончание поддержки
- 5.5 CVE: 241 KEV 1 Окончание поддержки
- 5.4 CVE: 243 KEV 2 Окончание поддержки
- 5.3 CVE: 310 KEV 1 Окончание поддержки
- 5.2 CVE: 410 KEV 1 Окончание поддержки
- 5.1 CVE: 382 KEV 1 Окончание поддержки
- 5.0 CVE: 388 KEV 1 Окончание поддержки
- 4.4 CVE: 396 KEV 1 Окончание поддержки
- 4.3 CVE: 400 KEV 1 Окончание поддержки
- 4.2 CVE: 401 KEV 1 Окончание поддержки
- 4.1 CVE: 400 KEV 1 Окончание поддержки
- 4.0 CVE: 409 KEV 1 Окончание поддержки
- 3.0 CVE: 344 KEV 1
- 2.0 CVE: 324 KEV 1
- 1.0 CVE: 324 KEV 1
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-109619 | RCE via stale global state | ≥ 5.4.0 < 8.2.35 ≥ 8.3.0 < 8.3.36 ≥ 8.4.0 < 8.4.27 | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | ≥ 7.3.0 < 8.2.35 ≥ 8.3.0 < 8.3.36 ≥ 8.4.0 < 8.4.27 | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2024-4577 | Argument Injection in PHP-CGI | ≥ 8.1.0 < 8.1.29 ≥ 8.2.0 < 8.2.20 ≥ 8.3.0 < 8.3.8 | 9.8 | KEV | 100.0% | 2024-06-10 |
| CVE-2019-11043 | Underflow in PHP-FPM can lead to RCE | ≥ 7.1.0 < 7.1.33 ≥ 7.2.0 < 7.2.24 ≥ 7.3.0 < 7.3.11 | 8.7 | KEV | 99.8% | 2019-10-28 |
| CVE-2012-1823 | sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi)... | < 5.3.12 ≥ 5.4.0 < 5.4.2 | 9.8 | KEV | 100.0% | 2012-05-11 |
| CVE-2026-92842 | OOB read / info leak in convert.* stream filters when line-break-chars contains NUL | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 5.9 | — | 2026-09-26 | |
| CVE-2026-91768 | IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 6.5 | — | 2026-09-26 | |
| CVE-2026-91769 | TLS Hostname Verification Falls Back to CN After SAN Mismatch | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 4.3 | — | 2026-09-26 | |
| CVE-2026-91767 | Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 6.5 | — | 2026-09-26 | |
| CVE-2025-1218 | Various packet overreads in mysqlnd_writeprotocol.c | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 3.4 | — | 2026-09-26 | |
| CVE-2026-91766 | Cross-origin credential leak in HTTP stream wrapper redirects | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 5.9 | — | 2026-09-26 | |
| CVE-2026-91765 | SOAP: Unbounded Recursion in Server-Side cleanup_xml_node | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 7.5 | — | 2026-09-26 | |
| CVE-2025-14181 | Integer overflow to buffer overflow in soap HTTP parsing | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 6.5 | — | 2026-09-26 | |
| CVE-2026-17545 | PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 6.9 | — | 2026-09-26 | |
| CVE-2026-6103 | Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 4.3 | — | 2026-09-26 | |
| CVE-2026-93682 | Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header | ≥ 8.2.0 < 8.2.34 ≥ 8.3.0 < 8.3.35 ≥ 8.4.0 < 8.4.26 | 5.8 | — | 2026-09-26 | |
| CVE-2026-7260 | Stack overflow in phar with circular symlinks | ≥ 8.2.0 < 8.2.33 ≥ 8.3.0 < 8.3.33 ≥ 8.4.0 < 8.4.24 | 5.4 | — | 2026-07-30 | |
| CVE-2026-17544 | Out-of-bounds write in bccomp() via crafted operand and scale | ≥ 8.4.0 < 8.4.24 ≥ 8.5.0 < 8.5.9 | 8.1 | — | 2026-07-30 | |
| CVE-2026-17543 | SQL injection in ext-pgsql via E'...' backslash breakout | ≥ 8.2.0 < 8.2.33 ≥ 8.3.0 < 8.3.33 ≥ 8.4.0 < 8.4.24 | 8.1 | — | 2026-07-30 | |
| CVE-2026-14355 | ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD | ≥ 8.2.0 < 8.2.32 ≥ 8.3.0 < 8.3.32 ≥ 8.4.0 < 8.4.23 | 5.6 | — | 2026-07-04 | |
| CVE-2026-7263 | DoS attack via DOMNode::C14N() | ≥ 8.4.0 < 8.4.21 ≥ 8.5.0 < 8.5.6 | 6.3 | — | 2026-05-10 | |
| CVE-2026-6104 | Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding | ≥ 8.4.0 < 8.4.21 ≥ 8.5.0 < 8.5.6 | 6.3 | — | 2026-05-10 | |
| CVE-2026-7258 | Out-of-bounds read in urldecode() on NetBSD | ≥ 8.2.0 < 8.2.21 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 6.3 | — | 2026-05-10 | |
| CVE-2026-6722 | Use-After-Free in SOAP using Apache map | ≥ 8.2.0 < 8.2.31 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 9.5 | — | 2026-05-10 | |
| CVE-2026-7259 | Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() | ≥ 8.2.0 < 8.2.31 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 2.1 | — | 2026-05-10 | |
| CVE-2026-7261 | SoapServer session-persisted object use-after-free via SOAP header fault | ≥ 8.2.0 < 8.2.31 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 6.3 | — | 2026-05-10 | |
| CVE-2026-7262 | NULL pointer dereference in SOAP apache:Map decoder with missing <value> | ≥ 8.2.0 < 8.2.31 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 2.9 | — | 2026-05-10 | |
| CVE-2025-14179 | SQL injection in pdo_firebird via NUL bytes in quoted strings | ≥ 8.2.0 < 8.2.31 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 7.4 | — | 2026-05-10 | |
| CVE-2026-7568 | Signed integer overflow in metaphone() | ≥ 8.2.0 < 8.2.31 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 6.3 | — | 2026-05-10 | |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | ≥ 8.2.0 < 8.2.31 ≥ 8.3.0 < 8.3.31 ≥ 8.4.0 < 8.4.21 | 7.3 | — | 2026-05-10 | |
| CVE-2025-14177 | Information Leak of Memory in getimagesize | ≥ 8.1.0 < 8.1.34 ≥ 8.2.0 < 8.2.30 ≥ 8.3.0 < 8.3.29 | 6.3 | — | 2025-12-28 | |
| CVE-2025-14178 | Heap buffer overflow in array_merge() | ≥ 8.1.0 < 8.1.34 ≥ 8.2.0 < 8.2.30 ≥ 8.3.0 < 8.3.29 | 6.5 | — | 2025-12-28 | |
| CVE-2025-14180 | NULL Pointer Dereference in PDO quoting | ≥ 8.1.0 < 8.1.34 ≥ 8.2.0 < 8.2.30 ≥ 8.3.0 < 8.3.29 | 8.2 | — | 2025-12-28 | |
| CVE-2025-1735 | pgsql extension does not check for errors during escaping | ≥ 8.1.0 < 8.1.33 ≥ 8.2.0 < 8.2.29 ≥ 8.3.0 < 8.3.23 | 5.9 | — | 2025-07-14 | |
| CVE-2025-1220 | Null byte termination in hostnames | ≥ 8.1.0 < 8.1.33 ≥ 8.2.0 < 8.2.29 ≥ 8.3.0 < 8.3.23 | 3.7 | — | 2025-07-14 | |
| CVE-2025-6491 | NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | ≥ 8.1.0 < 8.1.33 ≥ 8.2.0 < 8.2.29 ≥ 8.3.0 < 8.3.23 | 5.9 | — | 2025-07-14 | |
| CVE-2024-11235 | Reference counting in php_request_shutdown causes Use-After-Free | ≥ 8.3.0 < 8.3.19 ≥ 8.4.0 < 8.4.5 | 9.2 | — | 2025-04-05 | |
| CVE-2025-1861 | Stream HTTP wrapper truncates redirect location to 1024 bytes | ≥ 8.1.0 < 8.1.31 ≥ 8.2.0 < 8.2.26 ≥ 8.3.0 < 8.3.14 | 6.3 | — | 2025-03-30 | |
| CVE-2025-1736 | Stream HTTP wrapper header check might omit basic auth header | ≥ 8.1.0 < 8.1.32 ≥ 8.2.0 < 8.2.28 ≥ 8.3.0 < 8.3.19 | 6.3 | — | 2025-03-30 | |
| CVE-2025-1734 | Streams HTTP wrapper does not fail for headers with invalid name and no colon | ≥ 8.1.0 < 8.1.32 ≥ 8.2.0 < 8.2.28 ≥ 8.3.0 < 8.3.19 | 6.3 | — | 2025-03-30 | |
| CVE-2025-1219 | libxml streams use wrong content-type header when requesting a redirected resource | ≥ 8.1.0 < 8.1.32 ≥ 8.2.0 < 8.2.28 ≥ 8.3.0 < 8.3.19 | 6.3 | — | 2025-03-30 | |
| CVE-2025-1217 | Header parser of http stream wrapper does not handle folded headers | ≥ 8.1.0 < 8.1.32 ≥ 8.2.0 < 8.2.28 ≥ 8.3.0 < 8.3.19 | 6.3 | — | 2025-03-29 | |
| CVE-2022-31631 | PDO::quote() may return unquoted string | ≥ 8.0.0 < 8.0.27 ≥ 8.1.0 < 8.1.15 ≥ 8.2.0 < 8.2.2 | 9.1 | — | 2025-02-13 | |
| CVE-2024-11233 | Single byte overread with convert.quoted-printable-decode filter | ≥ 8.1.0 < 8.1.31 ≥ 8.2.0 < 8.2.26 ≥ 8.3.0 < 8.3.14 | 4.8 | — | 2024-11-24 | |
| CVE-2024-11234 | Configuring a proxy in a stream context might allow for CRLF injection in URIs | ≥ 8.1.0 < 8.1.31 ≥ 8.2.0 < 8.2.26 ≥ 8.3.0 < 8.3.14 | 4.8 | — | 2024-11-24 | |
| CVE-2024-11236 | Integer overflow in the firebird and dblib quoters causing OOB writes | ≥ 8.1.0 < 8.1.31 ≥ 8.2.0 < 8.2.26 ≥ 8.3.0 < 8.3.14 | 9.8 | — | 2024-11-24 | |
| CVE-2024-8929 | Leak partial content of the heap through heap buffer over-read in mysqlnd | ≥ 8.1.0 < 8.1.31 ≥ 8.2.0 < 8.2.26 ≥ 8.3.0 < 8.3.14 | 5.8 | — | 2024-11-22 | |
| CVE-2024-8932 | OOB access in ldap_escape | ≥ 8.1.0 < 8.1.31 ≥ 8.2.0 < 8.2.26 ≥ 8.3.0 < 8.3.14 | 9.8 | — | 2024-11-22 | |
| CVE-2024-9026 | PHP-FPM logs from children may be altered | ≥ 8.1.0 < 8.1.30 ≥ 8.2.0 < 8.2.24 ≥ 8.3.0 < 8.3.12 | 3.3 | — | 2024-10-08 | |
| CVE-2024-8927 | cgi.force_redirect configuration is bypassable due to the environment variable collision | ≥ 8.1.0 < 8.1.30 ≥ 8.2.0 < 8.2.24 ≥ 8.3.0 < 8.3.12 | 7.5 | — | 2024-10-08 | |
| CVE-2024-8926 | PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) | ≥ 8.1.0 < 8.1.30 ≥ 8.2.0 < 8.2.24 ≥ 8.3.0 < 8.3.12 | 8.1 | — | 2024-10-08 | |
| CVE-2024-8925 | Erroneous parsing of multipart form data | ≥ 8.1.0 < 8.1.30 ≥ 8.2.0 < 8.2.24 ≥ 8.3.0 < 8.3.12 | 3.1 | — | 2024-10-08 | |
| CVE-2024-2408 | PHP is vulnerable to the Marvin Attack | ≥ 8.1.0 < 8.1.29 ≥ 8.2.0 < 8.2.20 ≥ 8.3.0 < 8.3.8 | 5.9 | — | 2024-06-10 | |
| CVE-2024-5585 | Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) | ≥ 8.1.0 < 8.1.29 ≥ 8.2.0 < 8.2.20 ≥ 8.3.0 < 8.3.8 | 7.7 | — | 2024-06-10 | |
| CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | ≥ 7.3.27 ≤ 7.3.33 ≥ 7.4.15 ≤ 7.4.33 ≥ 8.0.2 ≤ 8.0.30 | 5.3 | — | 2024-06-10 | |
| CVE-2024-1874 | Command injection via array-ish $command parameter of proc_open() | ≥ 8.1.0 < 8.1.28 ≥ 8.2.0 < 8.2.18 ≥ 8.3.0 < 8.3.5 | 9.4 | — | 2024-04-29 | |
| CVE-2024-2757 | PHP mb_encode_mimeheader runs endlessly for some inputs | ≥ 8.3.0 < 8.3.5 | 7.5 | — | 2024-04-29 | |
| CVE-2024-3096 | PHP function password_verify can erroneously return true when argument contains NUL | ≥ 8.1.0 < 8.1.28 ≥ 8.2.0 < 8.2.18 ≥ 8.3.0 < 8.3.5 | 6.5 | — | 2024-04-29 | |
| CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | < 8.1.28 ≥ 8.2.0 < 8.2.18 ≥ 8.3.0 < 8.3.6 | 9.8 | — | 2024-04-10 | |
| CVE-2022-4900 | Potential buffer overflow in php_cli_server_startup_workers | < 8.0.22 | 6.2 | — | 2023-11-03 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).