PHP 7.3, end of life since 6 December 2021
PHP 7.3.33 vulnerabilities
PHP 7.3.33 is the last PHP 7.3 release. The US National Vulnerability Database lists 10 vulnerabilities for this version, 4 of them critical. 2 of them are on the CISA catalogue of known exploited vulnerabilities: CVE-2026-109618, CVE-2026-109619. Support for PHP 7.3 ended on 6 December 2021: flaws found since then get no official fix for it.
- 10known vulnerabilities
- 4critical
- 1high
- 2exploited in the wild
Actively exploited since 26 October 2026
PHP 7.3.33 is affected by PHP2Shell.
CVE-2026-109618 and CVE-2026-109619 let an attacker run code on your server without logging in. PHP fixed them only in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. We backport the fix to PHP 7.3.33 within 48 hours of your order, or within 24 hours with priority delivery.
What you can do
Keep PHP 7.3.33, patched
We backport the security fixes to the version you run. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported PHP release, if your applications can make the jump. The fixes keep you safe while you plan it.
Assess first
Our assessment shows which of these vulnerabilities are real on your servers, what else is outdated, and the remediation plan.
All 10 known vulnerabilities in PHP 7.3.33
| CVE | Score | Severity | Published | Description |
|---|---|---|---|---|
| CVE-2017-8923 | 9.8 | Critical | 2017-05-12 | The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string. |
| CVE-2022-37454 | 9.8 | Critical | 2022-10-21 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. |
| CVE-2024-3566 | 9.8 | Critical | 2024-04-10 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. |
| CVE-2026-109618 Exploited | 9.8 | Critical | 2026-10-21 | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). |
| CVE-2026-109619 Exploited | 8.1 | High | 2026-10-21 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). |
| CVE-2022-31629 | 6.5 | Medium | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications. |
| CVE-2022-4900 | 6.2 | Medium | 2023-11-02 | A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. |
| CVE-2024-5458 | 5.3 | Medium | 2024-06-09 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly. |
| CVE-2007-3205 | 5.0 | Medium | 2007-06-13 | The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin. |
| CVE-2022-31628 | 2.3 | Low | 2022-09-28 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. |