Twelve PHP CVEs in three days, none of them in PHP
I pulled every PHP-related advisory NVD published between 19 and 21 October. All twelve are plugins, CMS modules and libraries. That is the more useful signal: your real inventory is not the language.
PHP ships two 9.2 fixes today (the previous post covers how to prepare). Afterwards I checked something else: what PHP-related CVEs actually looked like on NVD over the past three days.
The result is counter-intuitive. None of the twelve is a vulnerability in the language or the runtime; every one sits in a plugin, a CMS module or a third-party library.
The twelve
Published 19–21 October, keyword PHP:
| ID | Target | Issue |
|---|---|---|
| CVE-2026-82814 | Duplicator / Duplicator Pro (WordPress) | PHP object injection, ≤1.5.17 and ≤4.6.10 |
| CVE-2026-111829 | WP Mailster (WordPress) | Remote file inclusion |
| CVE-2016-20101 | Issuu Panel (WordPress) | Unauthenticated file inclusion, <1.6.6 |
| CVE-2026-113402 | ArmorX Spam | Local file inclusion, authenticated |
| CVE-2026-111862 | Rank Math SEO PRO | Supply-chain compromise in some 3.0.123 packages |
| CVE-2026-113356 | DokuWiki | Draft content passed to unserialize (object injection) |
| CVE-2026-112777 | Craft CMS | Case-sensitivity bypass in Twig create() blocklist |
| CVE-2026-112291 | Flarum extension manager | Endpoint missing auth and admin checks |
| CVE-2026-112302 | kiwilan/php-archive | Path traversal in zip extraction |
| CVE-2026-112307 | sqlparse | PHP expression injection via SQL text |
| CVE-2026-112368 | MongoDB PHP driver | Unbounded recursion in BSON decoding |
| CVE-2026-113388 | opensource-socialnetwork | Input handling in an admin action |
Widen the window to start on 14 October and the same keyword returns 77. Three days is a small sample, but the shape is stable: mostly WordPress plugins.
File inclusion, object injection, supply chain — no bug in the language required.
Four familiar classes
File inclusion (4). A plugin wants “custom templates”, so a user-controlled value lands in include. The fix is never better filtering; it is not using a variable path.
Object injection (2). unserialize() ate something it should not have — a draft file in DokuWiki, backup data in Duplicator. The nasty part is that PHP object injection triggers __destruct / __wakeup, turning every magic method in the dependency tree into an entry point.
Supply chain (1). Part of Rank Math SEO PRO 3.0.123 was compromised. This is the uncomfortable one: you did nothing wrong, you updated a paid plugin to a normal version.
Missing authorisation (2). An extension-manager endpoint without an admin check; an admin feature without a role check.
Why “the core rarely breaks” is structural
PHP core has a fixed release cadence and a dedicated security team. Vulnerabilities are fixed privately, released together, and announced in advance — today’s notice is exactly that. The announcements are uniform, the version numbers clear, the branches covered.
The plugin ecosystem has none of that. A plugin may have one maintainer, no update for two years, and run on hundreds of thousands of sites. Its releases are not security releases; they are “while I was in there, I added a feature”.
Same language, two completely different risk models. Which means “I am on the latest PHP” is worth far less than “I know which plugins I have and which are still maintained”.
Four things I would do today
- Inventory. Export every plugin and version, then diff it against NVD. On WordPress,
wp plugin listis the whole job. - Delete what you do not use. Deactivated is not deleted: the code is still on disk and file-inclusion bugs still reach it.
- Read-only web root. Making the document root read-only for the PHP user kills a large family of “upload then execute” and “write a template” chains. Plugins that need a writable temp directory (Duplicator does) need an explicit exception.
- Split auto-updates. Security updates automatic, feature updates reviewed. Doing it the other way round usually costs two days of rollback after a major bump.
One judgement
Language bugs are frightening because there is nowhere to hide. Ecosystem bugs are frightening because you do not know how many doors you have. The first kind happens a few times a year and gets an announcement; the second happens dozens of times a day and gets none. Automate the second kind.
Comments
…