ZeusQA
Start free

Known exploited vulnerabilities

PHP vulnerabilities attackers have used

Every PHP vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 3 PHP vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2016-10033, added Jul 7, 2025. FastCGI Process Manager (FPM) has the most entries (1).

In KEV, all time
3
Added, last 12 months
0
Used in ransomware
1
New CVEs this week
0

By product

FastCGI Process Manager (FPM) (1), PHP (1), PHPMailer (1).

Every PHP entry in CISA KEV

  1. CVE-2016-10033

    Added · due

    PHPMailer Command Injection Vulnerability

    PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute…

  2. CVE-2019-11043

    RansomwareAdded · due

    PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

    In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.

  3. CVE-2012-1823

    Added · due

    PHP-CGI Query String Parameter Vulnerability

    sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works