Blog
Data from the phpwarden feed, written up. What is actually being exploited in the PHP ecosystem, and what to do about it.
Of 19,000 PHP vulnerabilities, 35 are being exploited. Here they are.
We ranked every PHP engine, Composer and WordPress CVE by real-world exploitation (CISA KEV + EPSS) instead of CVSS. A quarter of 'critical' CVEs have under 1% exploitation probability; the bugs attackers actually use are listed below.
11,800 WordPress CVEs, 7 in CISA KEV: the plugins attackers actually use
Every WordPress core, plugin and theme advisory in our feed, ranked by real exploitation (CISA KEV + EPSS). The plugins with the most advisories are not the ones being attacked; the ones being attacked are backup, file-manager and form plugins with unauthenticated upload or RCE bugs.
The Composer packages in CISA KEV (and the two that are dev dependencies)
1,500 Composer packages have published advisories. Only 24 CVEs across them are in CISA KEV, and they cluster in CMS cores: Drupal, Craft, Magento, October. For Laravel teams the three that matter are Ignition, Livewire and an old framework RCE.
Every PHP engine CVE with a fixed release, by branch (and which are exploited)
PHP backports fixes per branch, so 'upgrade to the latest' is the wrong check. Here is each engine CVE in the feed with the fixed release for 8.1, 8.2, 8.3, 8.4 and 8.5, which SAPI it needs, and which four are in CISA KEV, including the two October 2026 use-after-frees.