Loading story…
Three high-severity vulnerabilities have been disclosed in MixPHP Framework versions 2.x through 2.2.17, all tied to unsafe use of PHP unserialize() and carrying potential for remote code execution. CVE-2026-42472 affects Redis-backed session and cache handlers that deserialize data read from Redis, while CVE-2026-42473 impacts FileHandler session and cache logic that deserializes filesystem-sourced data. Both flaws are classified as CWE-502 and were assigned CVSS 3.1 scores reflecting network-exploitable, high-impact risk to confidentiality, integrity, and availability.
A separate issue, CVE-2026-42471, affects the framework’s sync-invoke client, where Connection.php reportedly calls unserialize() on server responses, creating a path to client-side remote code execution if a MixPHP client connects to a malicious server. The three CVEs were published with updated descriptions, references, and severity metadata, highlighting a broader pattern of insecure deserialization across MixPHP components and exposing both server-side and client-side attack surfaces in deployments running vulnerable releases.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
On the same day, the CVE records for CVE-2026-42471, CVE-2026-42472, and CVE-2026-42473 were updated with descriptions, references, CWE-502 classification, and CVSS v3.1 severity information. These updates formalized the technical characterization of the three MixPHP deserialization vulnerabilities.
Details were published for CVE-2026-42472, affecting MixPHP Framework 2.x through 2.2.17, involving unsafe use of PHP unserialize() on Redis-backed session and cache data in RedisHandler. The vulnerability was classified as CWE-502 with a high-severity CVSS v3.1 score vector.
Details were published for CVE-2026-42471, an unsafe deserialization issue in MixPHP Framework 2.x through 2.2.17 where Connection.php unserializes server response data in the sync-invoke client. The issue could allow client-side remote code execution when connecting to a malicious server.
MITRE recorded CVE-2026-42473 affecting MixPHP Framework 2.x through 2.2.17 for unsafe deserialization in FileHandler session and cache handling of filesystem-sourced data. The flaw was described as potentially enabling remote code execution with high impact.
A security disclosure reported six vulnerabilities in MixPHP 2.x through 2.2.17, including four unsafe-deserialization remote code execution flaws and two SQL injection issues affecting query builder functions. The report attributed the findings to Feng Ning of Innora Security Research and described the most severe network-accessible pre-auth deserialization flaw as CVSS 9.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegist.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in **PHP Composer** could let attackers execute arbitrary commands through the package manager’s **Perforce VCS driver**. The flaws, tracked as `CVE-2026-40176` and `CVE-2026-40261`, were caused by improper input validation and insufficient escaping when Composer built shell commands from repository configuration and source metadata. One issue can be triggered by a malicious `composer.json` in an untrusted root project, while the other can be exploited through a crafted source reference from a malicious or compromised repository. The bugs affect Composer versions `>= 2.3` and `< 2.9.6`, as well as `>= 2.0` and `< 2.2.27`, and were patched in **2.9.6** and **2.2.27 LTS**. Maintainers said injected commands could run even if Perforce is not installed on the target system. Composer, Packagist.org, and Private Packagist reported no evidence of active exploitation, but Packagist disabled publication of Perforce source metadata and the Perforce VCS driver as a precaution. Users were urged to update immediately, scrutinize `composer.json` files, rely only on trusted repositories, and avoid dependency installation via `--prefer-dist` or the `preferred-install: dist` setting.
Jun 29, 2026
Two high-severity file upload vulnerabilities have been disclosed in Laravel ecosystem components used for content and file management. **Sharp** versions prior to `9.20.0` are affected by `CVE-2026-33687`, which lets authenticated users bypass upload restrictions by tampering with a client-controlled `validation_rule` parameter so the server accepts files without intended MIME type or extension checks. The issue was fixed in `9.20.0` by removing client-side control over validation and enforcing checks server-side; the advisory also notes risk is reduced when uploads are stored on a strictly private disk and that default setups do not directly execute uploaded PHP files unless a public disk is configured. A separate disclosure, `CVE-2019-25673`, affects **UniSharp Laravel File Manager** `v2.0.0-alpha7` and `v2.0`, where authenticated attackers can submit multipart uploads with the `type` parameter set to `Files`, upload malicious PHP content, and then trigger **arbitrary code execution** by accessing the uploaded file from the working directory path. Both issues are classified as `CWE-434` unrestricted file upload flaws and carry high-impact severity scores, underscoring the risk that authenticated upload features in Laravel-based management tools can be abused to place attacker-controlled files on servers.
Jun 29, 2026
New CVE records document two high-severity web application vulnerabilities affecting **ThinkPHP 5.0.23** and **Ask Expert Script 3.0.5**. `CVE-2018-25270` describes an unauthenticated remote code execution flaw in ThinkPHP in which attackers can invoke functions through the routing parameter and send crafted requests to `index.php` to execute arbitrary PHP code. The issue is rated high impact across confidentiality, integrity, and availability under CVSS v3.1 and is referenced by public advisories and an Exploit-DB proof of concept. A separate entry, `CVE-2019-25676`, affects Ask Expert Script 3.0.5 and combines unauthenticated **cross-site scripting** and **SQL injection** weaknesses exposed through URL parameters. According to the record, attackers can inject script tags via the `cateid` parameter in `categorysearch.php` and inject SQL through the `view` parameter in `list-details.php`, potentially enabling browser-side code execution and database data extraction. The CVE maps the flaws to `CWE-79` and includes vendor, advisory, and exploit references, underscoring continued risk from exposed legacy PHP applications.
Jun 29, 2026