[UPDATE] [low] PHP: Multiple vulnerabilities allow unspecified attack

lowCVE-2026-44927 CVE-2026-44928

A local attacker can exploit multiple vulnerabilities in PHP and ZendPHP to conduct an unspecified attack.

CSIRTS triage

vendor: PHP product: PHPOther

What: Multiple vulnerabilities allow unspecified attack.
Who is affected: Local attackers can exploit vulnerabilities in PHP and ZendPHP.
Urgency: Remediation is low urgency as the severity is low and exploitation is not confirmed.
Action: Monitor for updates and apply patches when available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch PHP

Get an email when a new PHP advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: low
Published: 2026-07-17
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1793

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-449270.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.
Low exploitation riskCVE-2026-449280.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-44927	coverage & exploitation status	NVD · CVE.org
CVE-2026-44928	coverage & exploitation status	NVD · CVE.org

Recent advisories for PHP

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-53599: REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAl…nvd · 2026-07-31
unknownCVE-2026-46594: A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - …nvd · 2026-07-31
unknownCVE-2026-46593: A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improp…nvd · 2026-07-31
unknownCVE-2025-67651: A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers …nvd · 2026-07-31
unknownCVE-2025-67650: An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scrip…nvd · 2026-07-31
unknownCVE-2025-67649: A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Imprope…nvd · 2026-07-31