Loading story…
Phalcon disclosed and fixed a high-severity vulnerability in the Volt template compiler that allowed compile-time PHP code injection through the join filter, later tracked as CVE-2026-59989. In affected cphalcon versions earlier than 5.16.0, Phalcon\Mvc\View\Engine\Volt\Compiler::resolveFilter() inserted raw separator and array token values directly into generated PHP instead of safely compiling them with expression(). A crafted separator containing a quote could break out of the generated join() call, inject arbitrary PHP into the compiled template cache, and execute when Phalcon\Mvc\View\Engine\Volt::render() loaded the view, creating an SSTI-to-RCE path in environments where attackers can influence Volt template source.
The fix shipped in Phalcon Framework v5.16.0 and updates the compiler to emit both join arguments through expression(), with accompanying tests and changelog entries in the related pull request and commit history. The same release also included other security-relevant hardening, including fixes for catastrophic backtracking in router pattern compilation, infinite recursion during ORM hydration via model setters, improper $_REQUEST blacklist handling in Phalcon\Support\Debug, and stricter callback handling in Phalcon\Tag\Select::selectField(). The Volt issue is particularly significant for multi-tenant CMS, dashboard, and templating scenarios because successful exploitation could lead to arbitrary code execution in the web server process.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
The CVE record for the Phalcon Volt join filter vulnerability was newly received by GitHub Security Advisories as CVE-2026-59989. The advisory identifies the issue as affecting cphalcon versions earlier than 5.16.0 and references the fixing commit, pull request, and release.
The fix work associated with the Volt join filter issue was merged into master, with commit b9e8cc9 merged after review and passing checks. The pull request history shows the change was developed, reviewed, and tracked as part of the Phalcon v5 release workflow.
Phalcon 5.16.0 fixed cloneResultMap() so model setters are no longer called unconditionally during ORM hydration, preventing cases where setters that perform ORM queries could recurse infinitely. The release also added the orm.call_setters_on_hydration setting, defaulting to false, to make hydration-time setter execution opt-in.
The 5.16.0 release fixed Phalcon\Mvc\Router\Route::compilePattern() and Phalcon\Cli\Router\Route::compilePattern() so :params no longer expands to the nested quantifier (/.*)*, which could cause exponential-time processing on crafted URIs. Phalcon changed the trailing group compilation to (/.*)? to preserve parameter capture while restoring linear-time matching.
Phalcon released version 5.16.0 with a fix for a Volt compiler vulnerability in resolveFilter() where the join filter spliced raw arguments into generated PHP, enabling compile-time PHP code injection when rendered. The fix changed both join arguments to be emitted through expression() instead of concatenating raw token values.
A later mention on the pull request linked the Phalcon fix to an Argus threat intelligence entry for CVE-2026-59989. The mention described the issue as compile-time PHP code injection in the Volt compiler with possible SSTI-to-RCE impact.
The repository project workflow moved the tracked fix work from Implemented to Released in the Phalcon v5 project. This marked the change as released in project tracking after its June merge.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2024-56145** enables unauthenticated remote code execution in Craft CMS when PHP's `register_argc_argv` setting is enabled. Craft CMS bootstrap code accepted CLI-style options from the web-populated `$_SERVER['argv']` array, allowing query-string input to override application paths, including the templates directory. The affected condition was present in Craft CMS's official Docker configuration. An attacker can redirect template resolution to an attacker-controlled FTP server and leverage PHP's FTP stream wrapper to satisfy file-existence checks before Craft CMS downloads and renders a malicious Twig template. Although Twig blocked several direct dangerous callbacks, the published technique bypassed those restrictions through `call_user_func` used by the `sort` filter. Craft CMS fixed the flaw in versions **5.5.2** and **4.13.2** and later; organizations unable to upgrade should disable `register_argc_argv` and review exposed Craft deployments for suspicious template-path overrides.
Sep 3, 2026
CakePHP disclosed and patched **CVE-2026-77635**, a SQL injection flaw in `FunctionsBuilder::jsonValue()` when used with the PostgreSQL driver. The weakness allowed query manipulation if attacker-controlled input was passed to the `jsonPath` parameter, affecting CakePHP and `cakephp/database` versions `>= 5.1.0, < 5.1.10`, `>= 5.2.0, < 5.2.15`, and `>= 5.3.0, < 5.3.7`. The issue is tracked as **CWE-89** and carries a CVSS v4 assessment indicating network exploitability, low attack complexity, no privileges required, and high confidentiality and integrity impact. Maintainers released fixes across supported branches in commits for the `5.2.x`, `5.3.x`, and `5.x` lines, changing how PostgreSQL-specific `jsonValue` expressions are transformed. Regression tests added with the patches show legitimate JSON path extraction still works, while malicious path payloads now fail with a PostgreSQL syntax error surfaced as a `QueryException` instead of enabling successful query manipulation. The fix was credited to reporter **Himanshu Anand**, and patched releases include `5.1.10`, `5.2.15`, and `5.3.7`.
Aug 25, 2026
Two vulnerabilities in **phpTransformer 2016.9** have been documented, exposing the platform to remote attacks that can disclose sensitive data. `CVE-2019-25579` is a **directory traversal** flaw in the `jQueryFileUploadmaster` server endpoint that lets unauthenticated attackers read arbitrary files by manipulating a path parameter with traversal sequences such as `../../../../../../`. The issue is classified as `CWE-22`, and the published scoring indicates a high confidentiality impact without corresponding integrity or availability effects. A second issue, `CVE-2019-25578`, affects `GeneratePDF.php` and allows **SQL injection** through the `idnews` parameter in crafted `GET` requests. An attacker could use the flaw to run arbitrary SQL queries, extract database contents, or alter application query behavior. Both CVE records were published with references to **Exploit-DB** and a **VulnCheck advisory**, highlighting that phpTransformer 2016.9 contains multiple remotely exploitable weaknesses affecting both file access and backend database security.
Jun 29, 2026