PHP Multiple Vulnerabilities

Details

Source

HKCERT Security Bulletins (HK · national-cert · site)

Severity

unknown

Published

2026-08-03

Exploitation

Not in CISA KEV at last sync

Original advisory: https://www.hkcert.org/security-bulletin/php-multiple-vulnerabilities_20260803

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-72600.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all scored CVEs.
• Low exploitation riskCVE-2026-175430.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 31% of all scored CVEs.
• Low exploitation riskCVE-2026-175440.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownDSA-6409-1 libgd2 - security updatedebian
• high[NEU] [hoch] PHP: Mehrere Schwachstellencert-bund
• unknownMultiples vulnérabilités dans PHP (31 juillet 2026)cert-fr-avis
• unknownDSA-6406-1 php8.4 - security updatedebian
• unknownCVE-2026-7260: Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C st…nvd
• unknownCVE-2026-17544: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap …nvd
• unknownCVE-2026-17543: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL i…nvd

More from HKCERT Security Bulletins

• unknownRedHat Linux Kernel Multiple Vulnerabilities2026-08-03
• unknownUbuntu Linux Kernel Multiple Vulnerabilities2026-08-03
• unknownMicrosoft Edge Multiple Vulnerabilities2026-08-03
• unknownCisco Secure Firewall Management Center Software Information Disclosure Vulnerability2026-07-30
• unknownIBM WebSphere Products Multiple Vulnerabilities2026-07-30