products / php

PHP

PHP powers a large share of the web via CGI, php-fpm, and embedded SAPIs behind Apache and NGINX. NVD tracks cpe:2.3:a:php:php with deep historical coverage across 7.x and 8.x. CVE-2024-4577 (CISA KEV) is the current reference for exploited CGI argument injection on Windows.

api usage

Querying PHP

product slugphp

version format8.1.18, 8.3.14, 8.1.29

bash

curl "https://api.attestd.io/v1/check?product=php&version=8.1.18" \
  -H "Authorization: Bearer $ATTESTD_KEY"

PHP 8.1.18 falls in the CVE-2024-4577 range on the 8.1 line (fixed in 8.1.29). Windows PHP-CGI best-fit encoding bypass injects PHP CLI options and yields remote code execution. CISA lists this CVE in KEV, so the response marks active exploitation.

json

{
  "product": "php",
  "version": "8.1.18",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2016-15044",
    "CVE-2023-0567",
    "CVE-2023-3247",
    "CVE-2023-3823",
    "CVE-2023-3824",
    "CVE-2024-11233",
    "CVE-2024-11234",
    "CVE-2024-11236",
    "CVE-2024-1874",
    "CVE-2024-2408",
    "CVE-2024-3096",
    "CVE-2024-3566",
    "CVE-2024-4577",
    "CVE-2024-5458",
    "CVE-2024-5585",
    "CVE-2024-8925",
    "CVE-2024-8926",
    "CVE-2024-8927",
    "CVE-2024-8929",
    "CVE-2024-8932",
    "CVE-2024-9026",
    "CVE-2025-1217",
    "CVE-2025-1219",
    "CVE-2025-1220",
    "CVE-2025-14177",
    "CVE-2025-14178",
    "CVE-2025-14180",
    "CVE-2025-1734",
    "CVE-2025-1735",
    "CVE-2025-1736",
    "CVE-2025-1861",
    "CVE-2025-34292",
    "CVE-2025-6491",
    "CVE-2026-11407",
    "CVE-2026-1360",
    "CVE-2026-15979",
    "CVE-2026-23697",
    "CVE-2026-23698",
    "CVE-2026-34111",
    "CVE-2026-34113",
    "CVE-2026-34116",
    "CVE-2026-39932",
    "CVE-2026-41463",
    "CVE-2026-45247",
    "CVE-2026-48557",
    "CVE-2026-48907",
    "CVE-2026-49740",
    "CVE-2026-61873",
    "CVE-2026-64808",
    "CVE-2026-64809",
    "CVE-2026-69703",
    "CVE-2026-70554",
    "CVE-2026-71232"
  ],
  "cves": null,
  "max_epss": 0.99987,
  "last_updated": "2026-08-05T15:31:01.563651Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

PHP 8.3.14 is past the 8.3.8 cut for CVE-2024-4577 and the earlier 8.0–8.2 PHAR overflow ranges.

bash

curl "https://api.attestd.io/v1/check?product=php&version=8.3.14" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

PHP's highest-severity history clusters on CGI and FPM deployments that face the network. Several entries appear in the CISA KEV catalog, from the 2012 CGI argument-injection era through CVE-2024-4577 on Windows.

CVE	Description	Affects	CVSS
`CVE-2024-4577`KEV	Windows PHP-CGI best-fit encoding bypass injects PHP CLI options and yields remote code execution.	8.1.<29 / 8.2.<20 / 8.3.<8	9.8
`CVE-2019-11043`KEV	php-fpm under certain nginx configs writes past buffers and allows remote code execution.	7.1–7.3 cuts	9.8
`CVE-2023-3824`	Insufficient length checks when reading PHAR directory entries cause stack buffer overflow.	8.0–8.2 cuts	9.8
`CVE-2012-1823`KEV	PHP-CGI argument injection allows remote attackers to execute arbitrary code or disclose source. Listed in CISA KEV.	historical CGI	9.8

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Single CPE namespace

NVD publishes PHP interpreter CVEs under one long-lived CPE product identifier:

cpe:2.3:a:php:phpCGI, FPM, and core language CVEs

Attestd matches the php product slug against this namespace and aggregates overlapping branch cuts into a single check response.

All products Apache HTTP Server NGINX Quickstart