PHP vulnerabilities

6 vulnerabilities in PHP itself are in CISA's Known Exploited Vulnerabilities (KEV) catalog, and 9 more in products that build on PHP. Below them: PHP records that are not in KEV yet but already have a high exploit-prediction score.

• PHP itself in KEV
  6
  KEV entries since 3 Nov 2021
• Built on PHP
  9
  Other products in KEV that mention it
• Tied to ransomware
  13.3%
  2 of 15 marked as known ransomware use
• Most recent addition
  26 Oct 2026
• Outside KEV, EPSS ≥ 10%
  11
  Highest scores listed below

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Exploited vulnerabilities in PHP itself

KEV entries whose vendor or product is PHP.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026. About the data.

Exploited vulnerabilities in products built on PHP

KEV entries for other vendors' products that mention PHP in their name or product.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026. About the data.

Not in KEV yet, but likely to be exploited

Records in PHP itself that CISA does not list, ranked by FIRST's exploit-prediction score (probability of exploitation in the next 30 days). Only records with a score of 10% or more are shown. A new variant appears here as soon as its score rises, and moves to the list above when CISA adds it.

Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026. About the data.

Added to KEV per year

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026. About the data.

Vendors involved

• PHP 6
• Juniper 2
• ThinkPHP 2
• vBulletin 2
• phpMyAdmin 1
• PHPUnit 1
• Synacor 1

All exploited vulnerabilities · KEV catalog overview