Security

Report a vulnerability

SECURITY.md

Reporting Security Issues

Please report security vulnerabilities on GitHub at: https://github.com/php/php-src/security/advisories/new

If for some reason you cannot use the form at GitHub, or you need to talk to somebody about a PHP security issue that might not be a bug report, please write to [email protected].

Vulnerability reports remain private until published. When published, you will be credited as a contributor, and your contribution will reflect the MITRE Credit System.

Vulnerability Policy

Our full policy is described at https://github.com/php/policies/blob/main/security-classification.rst

Command injection via array-ish $command parameter of proc_open even if bypass_shell option enabled on Windows
GHSA-pc52-254m-w9w7 published Apr 11, 2024 by bukka

Critical
PHP is vulnerable to the Marvin Attack
GHSA-hh26-4ppw-5864 published Jun 6, 2024 by bukka

Moderate
Security issue with external entity loading in XML without enabling it
GHSA-3qrf-m4j2-pcrr published Aug 5, 2023 by smalyshev

High
Buffer overflow and overread in phar_dir_read()
GHSA-jqcx-ccgc-xwhv published Aug 5, 2023 by smalyshev

Critical
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
GHSA-76gg-c692-v2mw published Jun 12, 2023 by bukka

Low
BCrypt hashes erroneously validate if the salt is cut short by `$`
GHSA-7fj2-8x79-rjf4 published Feb 15, 2023 by smalyshev

Low
DoS vulnerability when parsing multipart request body
GHSA-54hq-v5wp-fqgv published Feb 15, 2023 by smalyshev

High

Learn more about advisories related to php/php-src in the GitHub Advisory Database