Related security incidents · updated 22 October 2026
Related security incidents for PHP site and server operators
Not every risk to a PHP site is a PHP CVE. These pages cover incidents in the libraries, trust stores, package registry and CMS ecosystem that PHP servers depend on, with checks you can run yourself.
Last updated
Incidents
- eMudhra weak CA keys (October 2026)Eight intermediate CA keys were trivially recoverable. Check whether PHP’s curl/OpenSSL bundle still trusts them.
- 2026 CMS webshell campaignACSC alert on mass exploitation of WordPress plugins, Craft CMS, Joomla JCE, MetInfo and MaxSite.
- laravel-lang and Packagist supply chain attacksHijacked tags on Packagist in April–May 2026 ran malware on install or on every request.
- OpenSSL high-severity advisories in 2026Three high-severity OpenSSL bugs; how to tell which OpenSSL your PHP build uses.
For the PHP2Shell runtime bugs themselves, start at the overview and remediation.
Sources
Outbound links leave this site. We do not host exploit code.
- Protecting Firefox users following the compromise of eMudhra intermediate certificates (20 October 2026) — Mozilla Security Blog
- Large-scale exploitation campaign targeting website content management systems (9 July 2026) — Australian Cyber Security Centre (ASD’s ACSC)
- An update on Composer & Packagist supply chain security (27 May 2026) — Packagist blog
- Vulnerabilities list — OpenSSL