https://patchfirst.co/vendor/php/New and newly exploited PHP CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-109618/CVE-2026-109618#kevMon, 26 Oct 2026 00:00:00 GMTPHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2026-109619/CVE-2026-109619#kevMon, 26 Oct 2026 00:00:00 GMTPHP Group · PHP. In CISA KEV since 2026-10-26. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.7 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2016-10033/CVE-2016-10033#kevMon, 07 Jul 2025 00:00:00 GMTPHP · PHPMailer. In CISA KEV since 2025-07-07. ENISA EUVD lists it as exploited. EPSS 99.7% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059.004 Unix Shell. Priority 69.9 of 100.kevpublic-exploitT1190T1059.004https://patchfirst.co/cve/CVE-2024-4577/CVE-2024-4577#kevWed, 12 Jun 2024 00:00:00 GMTPHP Group · PHP. In CISA KEV since 2024-06-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1033 System Owner/User Discovery; T1041 Exfiltration Over C2 Channel; +6 more. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059T1003T1003.001T1033T1041T1053T1068T1071.001T1112T1543T1570https://patchfirst.co/cve/CVE-2023-3824/CVE-2023-3824Fri, 11 Aug 2023 00:00:00 GMTPHP Group · PHP. Not in CISA KEV. EPSS 21.8% (higher than 97.6% of CVEs). CVSS 9.4 CRITICAL. Public exploit code exists. Priority 77.9 of 100.public-exploithttps://patchfirst.co/cve/CVE-2022-31626/CVE-2022-31626Thu, 16 Jun 2022 00:00:00 GMTPHP Group · PHP. Not in CISA KEV. EPSS 58.1% (higher than 99.09% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 30.1 of 100.public-exploithttps://patchfirst.co/cve/CVE-2019-11043/CVE-2019-11043#kevFri, 25 Mar 2022 00:00:00 GMTPHP · FastCGI Process Manager (FPM). In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2012-1823/CVE-2012-1823#kevFri, 25 Mar 2022 00:00:00 GMTPHP · PHP. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.9 of 100.kevpublic-exploitT1190T1059