Of 19,000 PHP vulnerabilities, 35 are being exploited. Here they are.

We ranked every PHP engine, Composer and WordPress CVE by real-world exploitation (CISA KEV + EPSS) instead of CVSS. A quarter of 'critical' CVEs have under 1% exploitation probability; the bugs attackers actually use are listed below.

Published 2026-10-28 · data: phpwarden feed 2026.10.28.1 (generated 2026-10-27) · sources: OSV.dev, FriendsOfPHP, NVD, CISA KEV, FIRST EPSS

Why we counted

Every PHP dependency scanner we tried sorts findings by CVSS. That produces a wall of red: in this feed 5,708 of 19,264 CVEs are rated high or critical. Nobody fixes 5,708 things, so the list gets ignored, which is worse than no list at all. We wanted to know how much of that red is real.

So we took every advisory phpwarden knows about — 8,599 Composer package advisories, 12,328 WordPress plugin/theme/core advisories and the PHP engine CVEs — and joined each one to two signals of real-world exploitation: CISA's Known Exploited Vulnerabilities catalog (confirmed in-the-wild exploitation) and FIRST's EPSS (a daily-updated probability that a CVE will be exploited in the next 30 days). 17,929 of the 19,264 have an EPSS score.

1. The feed by CVSS severity

This is what a CVSS-sorted scanner sees. 30% of everything is "high" or "critical".

2. The feed by actual exploitation

Exactly 35 of the 19,264 CVEs — 0.18% — are in CISA KEV. Widen the net to "EPSS says ≥10% chance of exploitation in the next 30 days" and you get 667 (3%). At ≥50% it is 226. The number of things a PHP team realistically needs to drop everything for is in the tens, not the thousands.

3. "Critical" is a weak predictor

There are 1,446 CVEs scored 9.0 or higher. 351 of them (24%) have an EPSS below 1% — attackers have shown essentially no interest. Only 270 (19%) clear a 10% EPSS. Meanwhile 156 CVEs with a CVSS under 7.0 ("medium" or lower) have an EPSS of 10% or more, and 5 of the 35 KEV entries are rated medium or carry no CVSS at all.

A few of the 9.0+ CVEs nobody is exploiting, to make the point concrete:

• CVE-2019-3809 — Moodle Blind SSRF Risk in /badges/mybackpack.php moodle/moodle CVSS 10.0, EPSS 0.84%
• CVE-2022-45822 — Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on advanced-booking-calendar (WordPress plugin) CVSS 10.0, EPSS 0.81%
• CVE-2023-51419 — Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your bertha-ai (WordPress plugin) CVSS 10.0, EPSS 0.63%
• CVE-2024-50496 — Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPr ar (WordPress plugin) CVSS 10.0, EPSS 0.51%
• CVE-2024-8615 — The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads du jobsearch-wp-job-board (WordPress plugin) CVSS 10.0, EPSS 0.86%
• CVE-2025-46337 — SQL injection in ADOdb PostgreSQL driver pg_insert_id() method adodb/adodb-php CVSS 10.0, EPSS 0.74%

None of these is "safe" — a patch is still the right answer. But if you have one afternoon, it should not go to these.

4. The 35 that are actually being exploited

Ranked by EPSS. Every row links to its advisory page with affected and fixed versions.

Where they cluster

By package: drupal/core (5), PHP engine (4), drupal/drupal (4), craftcms/cms (4), magento/community-edition (3), pear/archive_tar (2), WordPress core (2), phpunit/phpunit (1). CMS cores dominate — Drupal, Craft, Magento, WordPress — because an unauthenticated RCE in a CMS is worth automating at internet scale, and those are exactly the bugs that get automated.

Two of them are dev dependencies

CVE-2017-9841 (phpunit/phpunit) and CVE-2021-3129 (facade/ignition) are in KEV with an EPSS near 100%. Neither should exist on a production server: PHPUnit's eval-stdin.php and Ignition's debug error page are only reachable when require-dev packages were deployed. composer install --no-dev in your deploy step removes an entire class of these, and a scanner that checks whether a vulnerable package is actually reachable from your code will tell you which of the rest matter.

The PHP engine itself

4 engine CVEs are in KEV: CVE-2026-109618, CVE-2026-109619, CVE-2024-4577, CVE-2019-11043. These are the ones where "which PHP version are you on" is the whole question — and because PHP backports fixes per branch, the right check is "is 8.2.x at or above the fixed release for 8.2", not "are you on the latest major". An end-of-life branch has no fixed release at all.

5. Exploited, but not (yet) in KEV

KEV is curated and lags; EPSS moves daily. These have the highest EPSS of anything not in the catalog. If your scanner only knows about KEV, it does not know about these.

6. When the bugs were published

2024 was the biggest year in the feed, driven by WordPress plugin advisories. Volume is not risk: most of the 35 exploited CVEs are years old. Attackers do not need new bugs when old ones still work on unpatched hosts.

What to do with this

1. Sort by exploitation, not severity. KEV first, then EPSS, then CVSS. That is the order phpwarden uses, and it is why its CI mode has a fail-on: exploited setting instead of just a CVSS threshold.
2. Check reachability. A vulnerable package that nothing in your code calls is a lower priority than one on a request path. phpwarden deps composer.lock checks whether each vulnerable package is referenced.
3. Deploy without dev dependencies. Two of the most-exploited PHP CVEs on earth only bite if you did not.
4. Know your engine branch. 4 of the 35 are PHP itself; phpwarden scan compares your exact version against the fixed release of your branch.

pipx install phpwarden
phpwarden deps composer.lock        # Composer
phpwarden scan                      # PHP engine on this host
phpwarden wordpress /var/www/html   # WordPress core, plugins, themes

Method and caveats

• Data: the phpwarden feed, version 2026.10.28.1, built from OSV.dev, FriendsOfPHP/security-advisories and NVD (WordPress), enriched with CISA KEV and FIRST EPSS. 19,264 distinct CVEs, 20,935 (package, CVE) pairs. Browse it at /advisories.
• "Critical" means CVSS base score ≥ 9.0 as recorded by the source advisory. 1,051 CVEs have no score.
• EPSS is a probability for the next 30 days, as of the feed date; it changes daily. KEV membership is as of the feed date.
• EPSS and KEV measure exploitation on the internet at large, not in your environment. An unexploited bug on a high-value target is still a bug. The claim here is about priority, not about ignoring anything.
• Regenerate: scripts/build_blog.py in the phpwarden repo.