PHP 7.2, end of life since 30 November 2020
PHP 7.2.34 vulnerabilities
PHP 7.2.34 is the last PHP 7.2 release. The US National Vulnerability Database lists 8 vulnerabilities for this version, 3 of them critical. One of them is on the CISA catalogue of known exploited vulnerabilities: CVE-2026-109619. Support for PHP 7.2 ended on 30 November 2020: flaws found since then get no official fix for it.
- 8known vulnerabilities
- 3critical
- 1high
- 1exploited in the wild
Actively exploited since 26 October 2026
PHP 7.2.34 is affected by PHP2Shell.
CVE-2026-109619 lets an attacker run code on your server without logging in. PHP fixed it only in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. We backport the fix to PHP 7.2.34 within 48 hours of your order, or within 24 hours with priority delivery.
What you can do
Keep PHP 7.2.34, patched
We backport the security fixes to the version you run. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported PHP release, if your applications can make the jump. The fixes keep you safe while you plan it.
Assess first
Our assessment shows which of these vulnerabilities are real on your servers, what else is outdated, and the remediation plan.
All 8 known vulnerabilities in PHP 7.2.34
| CVE | Score | Severity | Published | Description |
|---|---|---|---|---|
| CVE-2017-8923 | 9.8 | Critical | 2017-05-12 | The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string. |
| CVE-2022-37454 | 9.8 | Critical | 2022-10-21 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. |
| CVE-2024-3566 | 9.8 | Critical | 2024-04-10 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. |
| CVE-2026-109619 Exploited | 8.1 | High | 2026-10-21 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). |
| CVE-2022-31629 | 6.5 | Medium | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications. |
| CVE-2022-4900 | 6.2 | Medium | 2023-11-02 | A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. |
| CVE-2007-3205 | 5.0 | Medium | 2007-06-13 | The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin. |
| CVE-2022-31628 | 2.3 | Low | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. |