Vendor

PHP

As of , 3 PHP vulnerabilities are on CISA's list of exploited vulnerabilities, 1 of them used in ransomware campaigns; 0 were added in 2026. Patch first: CVE-2016-10033.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2016-10033Command InjectionPHP PHPMailerPatch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
2CVE-2012-1823PHP-CGI Query String ParameterPHP PHPPatch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry0.99
3CVE-2019-11043Buffer OverflowPHP FastCGI Process Manager (FPM)Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99

Products

  • FastCGI Process Manager (FPM)1 entry
  • PHP1 entry
  • PHPMailer1 entry

Added each year

0.511.522022: 2220222023: nonenone20232024: nonenone20242025: 1120252026: nonenone2026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20222
2023none
2024none
20251
2026none

Used in ransomware