[UPDATE] [high] PHP: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities allow an attacker to execute arbitrary code, perform SQL injection, cross-site scripting, manipulate data, disclose information, or cause denial-of-service conditions.

Who is affected

Deployments of PHP are affected.

Urgency

Remediation is critical due to the high severity of the vulnerabilities.

Action

Update PHP to the latest version.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-07-07

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1433

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2025-141790.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
• Low exploitation riskCVE-2026-61040.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.
• Low exploitation riskCVE-2026-67220.74% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all scored CVEs.
• Low exploitation riskCVE-2026-67350.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all scored CVEs.
• Low exploitation riskCVE-2026-72580.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all scored CVEs.
• Low exploitation riskCVE-2026-72590.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
• Low exploitation riskCVE-2026-72610.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
• Low exploitation riskCVE-2026-72620.78% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 52% of all scored CVEs.
• Low exploitation riskCVE-2026-72630.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
• Low exploitation riskCVE-2026-75680.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• unknownUSN-8513-1: PHP vulnerabilitiesubuntu

Recent advisories for PHP

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownCVE-2026-57584: Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC ap…nvd · 2026-07-10
• unknownCVE-2026-54736: Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\C…nvd · 2026-07-10
• criticalGHSA-m5f5-28qr-9g9r: prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthen…ghsa · 2026-07-10
• unknownCVE-2026-55466: Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes…nvd · 2026-07-10
• highCVE-2026-59856: Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion sc…nvd · 2026-07-09
• criticalGHSA-9369-69wj-7m2f: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unseria…ghsa · 2026-07-09

More from CERT-Bund (BSI) Security Advisories

• medium[NEW] [medium] DENX U-Boot: Multiple vulnerabilities allow execution of arbitrary code and DoS2026-07-10
• medium[NEW] [medium] Samsung Android: Multiple vulnerabilities2026-07-10
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-10
• medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10