# Multiple vulnerabilities in PHP versions 8.2-8.5

Published: 2026-09-24 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/b07f646d-e729-5d3c-b77a-8a925a04a2ef/multiple-vulnerabilities-in-php-versions-8-2-8-5

> Ten CVEs affect PHP 8.2 through 8.5, enabling remote DoS, data theft, integrity compromise, and policy bypass.

CERT-FR has published a security advisory detailing multiple vulnerabilities across PHP versions 8.2.x, 8.3.x, 8.4.x, and 8.5.x. The affected versions are: PHP 8.2 prior to 8.2.34, PHP 8.3 prior to 8.3.35, PHP 8.4 prior to 8.4.26, and PHP 8.5 prior to 8.5.11. These vulnerabilities carry a broad impact spectrum, including remote denial-of-service attacks, data confidentiality breaches, data integrity violations, and security policy circumvention.

The advisory references ten CVEs spanning CVE-2025-1218, CVE-2025-14181, and CVE-2026-6103 through CVE-2026-93682. Defenders running PHP in production should prioritize patching to the latest stable releases in their respective version branches. The advisory directs administrators to the official PHP security bulletins for detailed patch information and remediation guidance. No details on active exploitation in the wild are provided in the public advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2025-1218, CVE-2025-14181, CVE-2026-17545, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768, CVE-2026-91769, CVE-2026-92842, CVE-2026-93682

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1227

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b07f646d-e729-5d3c-b77a-8a925a04a2ef/multiple-vulnerabilities-in-php-versions-8-2-8-5.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup