PHP Group vulnerabilities
- PHP Group has 56 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #208 of 420 vendors on this site by that count.
- Of the 56 with a CVSS score, 19 (33.9%) are rated critical or high; 0 (0% of all) have no CVSS score.
- 3 vulnerabilities attributed to PHP Group are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-109618, was added on 26 Oct 2026.
- 1 of them (33.3%) is marked as known to be used in ransomware campaigns.
- For the 3 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 5 days.
Records are attributed to PHP Group from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 15 |
| 2020 | 13 |
| 2021 | 7 |
| 2022 | 7 |
| 2023 | 6 |
| 2024 | 17 |
| 2025 | 13 |
| 2026 | 26 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 26 | 3 | 5 | 30.8% | 0% |
| 2025 | 13 | 2 | 1 | 23.1% | 0% |
| 2024 | 17 | 4 | 4 | 47.1% | 0% |
| 2023 | 6 | 1 | 4 | 83.3% | 0% |
| 2022 | 7 | 0 | 4 | 57.1% | 0% |
| 2021 | 7 | 0 | 1 | 14.3% | 0% |
| 2020 | 13 | 0 | 3 | 23.1% | 0% |
| 2019 | 15 | 0 | 0 | 0% | 0% |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 0 | 0 | 0 | — | — |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-109618 | PHP | PHP Memory Corruption Vulnerability | 2026-10-26 | Unknown |
| CVE-2026-109619 | PHP | PHP Stale Internal Request-State Vulnerability | 2026-10-26 | Unknown |
| CVE-2024-4577 | PHP | PHP-CGI OS Command Injection Vulnerability | 2024-06-12 | Known |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring PHP Group records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2026-109618 | 100% | 100% | Critical | Yes |
| CVE-2026-109619 | 100% | 100% | Critical | Yes |
| CVE-2024-4577 | 100% | 100% | Critical | Yes |
| CVE-2022-31626 | 58.1% | 99.1% | High | No |
| CVE-2022-31629 | 49.6% | 98.9% | Medium | No |
| CVE-2024-2756 | 38.1% | 98.6% | Medium | No |
| CVE-2024-1874 | 32.6% | 98.3% | Critical | No |
| CVE-2024-5585 | 28.8% | 98.1% | High | No |
| CVE-2021-21707 | 25.3% | 97.9% | Medium | No |
| CVE-2023-3824 | 21.8% | 97.6% | Critical | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.