ZeusQA
Start free

Known exploited vulnerabilities

PHP Group vulnerabilities attackers have used

Every PHP Group vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 3 PHP Group vulnerabilities as exploited in the wild, 2 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2026-109619, added Oct 26, 2026. PHP has the most entries (3).

In KEV, all time
3
Added, last 12 months
2
Used in ransomware
1
New CVEs this week
0

Every PHP Group entry in CISA KEV

  1. CVE-2026-109619

    Added · due

    PHP Stale Internal Request-State Vulnerability

    PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

  2. CVE-2026-109618

    Added · due

    PHP Memory Corruption Vulnerability

    PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

  3. CVE-2024-4577

    RansomwareAdded · due

    PHP-CGI OS Command Injection Vulnerability

    PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works