CERT-FR warns of multiple PHP vulnerabilities
CERT-FR advises patching PHP 8.2-8.5 branches to fix flaws enabling SQL injection and denial of service.
CERT-FR issued an advisory covering multiple vulnerabilities in PHP affecting versions 8.2.x prior to 8.2.33, 8.3.x prior to 8.3.33, 8.4.x prior to 8.4.24, and 8.5.x prior to 8.5.9. The flaws, tracked under four CVE identifiers, allow attackers to trigger SQL injection, denial of service, and an unspecified security issue as described by the vendor.
The PHP project released patched versions (8.2.33, 8.3.33, 8.4.24, and 8.5.9) on July 30, 2026, addressing these issues. There is no indication in the advisory of active exploitation in the wild; organizations running affected PHP versions are advised to upgrade to the fixed releases referenced in the official PHP changelogs.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0952
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free