LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Php

10 CVEs published in the last four months and 3 stories. Exploited flaws first.

Critical6
High4
Medium0
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2025-141799.8criticalphpIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Fir166d ago
CVE-2026-67229.8criticalphpIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP ext166d ago
CVE-2026-72619.8criticalphpIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapSer166d ago
CVE-2026-175439.8criticalphpImproper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP vers85d ago
CVE-2026-175449.8criticalphpAttacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP ve85d ago
CVE-2026-61049.1criticalphpIn PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte i166d ago
CVE-2026-75687.5highphpIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphon166d ago
CVE-2026-72587.5highphpIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functio166d ago
CVE-2026-72637.5highphpIn PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorre166d ago
CVE-2026-72627.5highphpIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP 166d ago

Filter the full tracker by Php →

Our coverage of Php

CVE-2026-32475critical

Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code

Cybersecurity researchers have reported a critical vulnerability in the Elementor Pro WordPress plugin that could enable unauthenticated attackers to upload PHP files and achieve remote code execution. The flaw, identified as CVE-2026-32475, has been assigned a CVSS score of 9.0, indicating a high level of severity.

CVE-2026-15748critical

Forminator WordPress Plugin Vulnerable to Remote Code Execution

A critical remote code execution (RCE) vulnerability has been reported in the Forminator WordPress plugin, a tool utilized by over 600,000 websites. The flaw reportedly allows unauthenticated attackers to execute arbitrary code on affected sites. This vulnerability carries a high severity rating, indicating a significant risk to the integrity and security of websites employing the plugin.

CVE-2026-64638high

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

A newly discovered pre-authentication reflected cross-site scripting (XSS) vulnerability has been identified in the login screen of WordPress, affecting all versions of the content management system. This high-severity flaw, tracked as CVE-2026-64638 with a CVSS score of 8.9, requires no prior attacker privileges and can, under specific additional conditions, be chained to achieve PHP code…