Every PHP engine CVE with a fixed release, by branch (and which are exploited)
PHP backports fixes per branch, so 'upgrade to the latest' is the wrong check. Here is each engine CVE in the feed with the fixed release for 8.1, 8.2, 8.3, 8.4 and 8.5, which SAPI it needs, and which four are in CISA KEV, including the two October 2026 use-after-frees.
Why "upgrade to the latest PHP" is the wrong check
PHP ships security fixes to every supported branch at once. A CVE fixed in 8.3.36 is also fixed in 8.2.35 and 8.4.27 — and not fixed in 8.3.35. So the question for a host is never "are you on 8.5" but "is your 8.3.x at or above the 8.3 fix". And a branch that is end-of-life (7.1, 7.2, 7.3, 8.0, 8.1) has no fixed release at all: a host on it is exposed to every CVE published after its last release, forever.
Several of these also only apply to one SAPI. CVE-2019-11043 needs PHP-FPM behind nginx with a specific misconfiguration; the CGI ones need php-cgi, and CVE-2024-4577 needs Windows. phpwarden reports those as possibly exposed with the condition to check rather than as a certain hit.
Every engine CVE in the feed, with the fixed release per branch
"—" means the branch has no fix: either it was not affected, or it was already end-of-life when the CVE was published.
| CVE | What | SAPI | 8.1 | 8.2 | 8.3 | 8.4 | 8.5 |
|---|---|---|---|---|---|---|---|
CVE-2026-109618 KEVcritical 9.2 · EPSS 100% | Upload-progress use-after-free and remote process-memory disclosure | any | — | 8.2.35 | 8.3.36 | 8.4.27 | 8.5.12 |
CVE-2026-109619 KEVcritical 9.2 · EPSS 100% | Fatal-error backtrace use-after-free and OPcache type confusion | any | — | 8.2.35 | 8.3.36 | 8.4.27 | 8.5.12 |
CVE-2024-4577 KEVcritical 9.8 · EPSS 100% | PHP-CGI argument injection to RCE on Windows via Best-Fit encoding | cgi / windows | 8.1.29 | 8.2.20 | 8.3.8 | — | — |
CVE-2019-11043 KEVcritical 9.8 · EPSS 100% | PHP-FPM remote code execution via env_path_info buffer underflow | fpm | — | — | — | — | — |
CVE-2023-3824critical 9.8 · EPSS 22% | Stack buffer overflow / RCE when loading a crafted PHAR archive | any | 8.1.22 | 8.2.8 | — | — | — |
CVE-2024-8926high 7.5 · EPSS 4% | PHP-CGI cgi.force_redirect bypass on non-standard code pages (incomplete CVE-2024-4577 fix) | cgi / windows | 8.1.30 | 8.2.24 | 8.3.12 | — | — |
CVE-2024-11236critical 9.8 · EPSS 2% | Integer overflow causing out-of-bounds write in DB quoters / ldap_escape | any | 8.1.31 | 8.2.26 | 8.3.14 | — | — |
CVE-2024-8927high 7.5 · EPSS 1% | cgi.force_redirect bypass via HTTP_PROXY-style environment variable collision | cgi, fpm | 8.1.30 | 8.2.24 | 8.3.12 | — | — |
The 4 in CISA KEV
CVE-2026-109618— Upload-progress use-after-free and remote process-memory disclosure (published 2026-10-21, EPSS 100%)CVE-2026-109619— Fatal-error backtrace use-after-free and OPcache type confusion (published 2026-10-21, EPSS 100%)CVE-2024-4577— PHP-CGI argument injection to RCE on Windows via Best-Fit encoding (published 2024-06-06, EPSS 100%)CVE-2019-11043— PHP-FPM remote code execution via env_path_info buffer underflow (published 2019-10-24, EPSS 100%)
Two of them were published on 2026-10-21 and were in KEV within a week. Both are use-after-frees reachable remotely on common FPM setups, both have fixes in every supported branch, and neither has a fix for 8.1 or older.
What to do
- Check the branch, not the major.
phpwarden scanauto-detects version, SAPI and OS on the host and compares against the fixed release for that branch;phpwarden scan --version 8.2.34 --sapi fpm --os linuxdoes it for a version you type in. - Get off end-of-life branches first. It is the only item on this page with no patch.
- For FPM hosts you cannot patch today, the guard daemon watches workers for in-progress memory-corruption exploitation and recycles them — a stopgap, not a fix.
Check your own project in one command
Zero dependencies, offline, Apache-2.0. Ranks by KEV → EPSS → CVSS.
pipx install phpwarden
phpwarden deps composer.lock # Composer
phpwarden scan # PHP engine on this host
phpwarden wordpress /var/www/html # WordPress core, plugins, themesIn CI: uses: primeagent001-bot/phpwarden-action@v1
with fail-on: exploited. Or composer require --dev phpwarden/phpwarden.