PHP 8.0, end of life since 26 November 2023
PHP 8.0.30 vulnerabilities
PHP 8.0.30 is the last PHP 8.0 release. The US National Vulnerability Database lists 5 vulnerabilities for this version, 2 of them critical. 2 of them are on the CISA catalogue of known exploited vulnerabilities: CVE-2026-109618, CVE-2026-109619. Support for PHP 8.0 ended on 26 November 2023: flaws found since then get no official fix for it.
- 5known vulnerabilities
- 2critical
- 1high
- 2exploited in the wild
Actively exploited since 26 October 2026
PHP 8.0.30 is affected by PHP2Shell.
CVE-2026-109618 and CVE-2026-109619 let an attacker run code on your server without logging in. PHP fixed them only in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. We backport the fix to PHP 8.0.30 within 48 hours of your order, or within 24 hours with priority delivery.
What you can do
Keep PHP 8.0.30, patched
We backport the security fixes to the version you run. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported PHP release, if your applications can make the jump. The fixes keep you safe while you plan it.
Assess first
Our assessment shows which of these vulnerabilities are real on your servers, what else is outdated, and the remediation plan.
All 5 known vulnerabilities in PHP 8.0.30
| CVE | Score | Severity | Published | Description |
|---|---|---|---|---|
| CVE-2024-3566 | 9.8 | Critical | 2024-04-10 | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. |
| CVE-2026-109618 Exploited | 9.8 | Critical | 2026-10-21 | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). |
| CVE-2026-109619 Exploited | 8.1 | High | 2026-10-21 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). |
| CVE-2024-5458 | 5.3 | Medium | 2024-06-09 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly. |
| CVE-2007-3205 | 5.0 | Medium | 2007-06-13 | The parse_str function in (1) PHP, (2) Hardened-PHP, and (3) Suhosin, when called without a second parameter, might allow remote attackers to overwrite arbitrary variables by specifying variable names and values in the string to be parsed. NOTE: it is not clear whether this is a design limitation of the function or a bug in PHP, although it is likely to be regarded as a bug in Hardened-PHP and Suhosin. |