# PHP security incidents · pwn.watch

> Security incidents affecting PHP, plus apps and CMSs built on it (WordPress, Drupal, Joomla, Magento).

Page: https://pwn.watch/t/php · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 28 (1 live, 1 live and not fully patched, 26 patched)
- Days without a PHP security incident: 0 (1 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-18

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/php.json
- RSS (every update): https://pwn.watch/t/php/feed.xml
- This file: https://pwn.watch/t/php/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored](https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor) ([json](https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor.json)): high, closed, partial, started 2026-10-18
- [PHP2Shell: critical unauthenticated RCE in PHP core](https://pwn.watch/i/php2shell-cve-2026-109618-109619) ([json](https://pwn.watch/i/php2shell-cve-2026-109618-109619.json)): critical, live, partial, started 2026-10-17, CVE-2026-109618, CVE-2026-109619
- [Rank Math PRO WordPress plugin download backdoored](https://pwn.watch/i/rank-math-pro-wordpress-backdoor) ([json](https://pwn.watch/i/rank-math-pro-wordpress-backdoor.json)): critical, closed, patched, started 2026-10-15
- [WordPress Core: WordPress Core Remote File Inclusion Vulnerability](https://pwn.watch/i/wordpress-core-cve-2026-87902) ([json](https://pwn.watch/i/wordpress-core-cve-2026-87902.json)): high, closed, patched, started 2026-09-25, CVE-2026-87902
- [Adobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability ](https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362) ([json](https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-71362.json)): high, closed, patched, started 2026-09-24, CVE-2026-71362
- [Adobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability](https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650) ([json](https://pwn.watch/i/adobe-commerce-and-magento-cve-2026-75650.json)): high, closed, patched, started 2026-09-08, CVE-2026-75650
- [WordPress Core: WordPress Core SQL Injection Vulnerability](https://pwn.watch/i/wordpress-core-cve-2026-60137) ([json](https://pwn.watch/i/wordpress-core-cve-2026-60137.json)): high, closed, patched, started 2026-07-21, CVE-2026-60137, CVE-2026-63030
- [Joomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerability](https://pwn.watch/i/joomlack-page-builder-cve-2026-56290) ([json](https://pwn.watch/i/joomlack-page-builder-cve-2026-56290.json)): high, closed, patched, started 2026-07-07, CVE-2026-56290
- [Widget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerability](https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907) ([json](https://pwn.watch/i/widget-factory-joomla-content-editor-cve-2026-48907.json)): high, closed, patched, started 2026-06-16, CVE-2026-48907
- [Drupal Core: Drupal Core SQL Injection Vulnerability](https://pwn.watch/i/drupal-core-cve-2026-9082) ([json](https://pwn.watch/i/drupal-core-cve-2026-9082.json)): high, closed, patched, started 2026-05-22, CVE-2026-9082
- [Adobe Commerce and Magento: Commerce and Magento Improper Input Validation Vulnerability](https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236) ([json](https://pwn.watch/i/adobe-commerce-and-magento-cve-2025-54236.json)): critical, closed, patched, started 2025-10-24, CVE-2025-54236
- [Adminer: Server-Side Request Forgery Vulnerability](https://pwn.watch/i/adminer-cve-2021-21311) ([json](https://pwn.watch/i/adminer-cve-2021-21311.json)): high, closed, patched, started 2025-09-29, CVE-2021-21311
- [PHPMailer: PHPMailer Command Injection Vulnerability](https://pwn.watch/i/phpmailer-cve-2016-10033) ([json](https://pwn.watch/i/phpmailer-cve-2016-10033.json)): critical, closed, patched, started 2025-07-07, CVE-2016-10033
- [Roundcube Webmail: Webmail Cross-Site Scripting Vulnerability](https://pwn.watch/i/roundcube-webmail-cve-2024-42009) ([json](https://pwn.watch/i/roundcube-webmail-cve-2024-42009.json)): critical, closed, patched, started 2025-06-09, CVE-2024-42009
- [Craft CMS: 2 exploited vulnerabilities (CVE-2024-56145, CVE-2025-35939)](https://pwn.watch/i/craft-cms-cve-2024-56145) ([json](https://pwn.watch/i/craft-cms-cve-2024-56145.json)): critical, closed, patched, started 2025-06-02, CVE-2024-56145, CVE-2025-35939
- [Yiiframework Yii: Yii Improper Protection of Alternate Path Vulnerability](https://pwn.watch/i/yiiframework-yii-cve-2024-58136) ([json](https://pwn.watch/i/yiiframework-yii-cve-2024-58136.json)): critical, closed, patched, started 2025-05-02, CVE-2024-58136
- [Craft CMS: Code Injection Vulnerability](https://pwn.watch/i/craft-cms-cve-2025-23209) ([json](https://pwn.watch/i/craft-cms-cve-2025-23209.json)): high, closed, patched, started 2025-02-20, CVE-2025-23209
- [ProjectSend Improper Authentication](https://pwn.watch/i/projectsend-cve-2024-11680) ([json](https://pwn.watch/i/projectsend-cve-2024-11680.json)): critical, closed, patched, started 2024-11-26, CVE-2024-11680
- [LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)](https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000) ([json](https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000.json)): critical, closed, patched, started 2024-08-13, CVE-2024-28000
- [Roundcube Webmail Cross-Site Scripting (XSS)](https://pwn.watch/i/roundcube-webmail-cve-2020-13965) ([json](https://pwn.watch/i/roundcube-webmail-cve-2020-13965.json)): medium, closed, patched, started 2024-06-26, CVE-2020-13965
- [Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE)](https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102) ([json](https://pwn.watch/i/adobe-commerce-and-magento-open-source-cve-2024-34102.json)): critical, closed, patched, started 2024-06-13, CVE-2024-34102
- [RoundCube Webmail Cross-Site Scripting (XSS)](https://pwn.watch/i/roundcube-webmail-cve-2024-37383) ([json](https://pwn.watch/i/roundcube-webmail-cve-2024-37383.json)): medium, closed, patched, started 2024-06-07, CVE-2024-37383
- [PHP-CGI argument injection on Windows (CVE-2024-4577)](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577) ([json](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json)): critical, closed, patched, started 2024-06-06, CVE-2024-4577
- [Roundcube Webmail Persistent Cross-Site Scripting (XSS)](https://pwn.watch/i/roundcube-webmail-cve-2023-43770) ([json](https://pwn.watch/i/roundcube-webmail-cve-2023-43770.json)): medium, closed, patched, started 2024-02-12, CVE-2023-43770
- [Laravel Deserialization of Untrusted Data](https://pwn.watch/i/laravel-framework-cve-2018-15133) ([json](https://pwn.watch/i/laravel-framework-cve-2018-15133.json)): high, closed, patched, started 2024-01-16, CVE-2018-15133
- [Joomla! Improper Access Control](https://pwn.watch/i/joomla-cve-2023-23752) ([json](https://pwn.watch/i/joomla-cve-2023-23752.json)): medium, closed, patched, started 2024-01-08, CVE-2023-23752
- [ownCloud graphapi: Information Disclosure (CVE-2023-49103)](https://pwn.watch/i/owncloud-graphapi-cve-2023-49103) ([json](https://pwn.watch/i/owncloud-graphapi-cve-2023-49103.json)): high, closed, patched, started 2023-11-30, CVE-2023-49103
- [Roundcube Webmail: Persistent Cross-Site Scripting (XSS) (CVE-2023-5631)](https://pwn.watch/i/roundcube-webmail-cve-2023-5631) ([json](https://pwn.watch/i/roundcube-webmail-cve-2023-5631.json)): medium, closed, patched, started 2023-10-26, CVE-2023-5631