PHP Vulnerabilities

Summarizes security flaws in PHP applications and runtimes, major attack types, and countermeasures.

PHP Vulnerabilities

Overview

PHP vulnerabilities collectively refer to security flaws arising in web applications written in PHP and in the PHP runtime and configuration. When insufficient input validation, incorrect use of file, command, and DB handling, outdated versions, and improper server configuration combine, they can lead to critical incidents such as remote code execution (RCE), SQL injection, and authentication bypass. Because they are often caused by application code and operational configuration rather than flaws in PHP itself, security controls at every stage of development, deployment, and operations are important.

Key Details

Causes and Characteristics

PHP is widely used in web hosting, CMSs, and legacy systems, so its attack surface is large. Dynamic typing and loose comparison, the variety of file, URL, and command execution functions, and code written directly outside frameworks increase vulnerabilities. Past features such as register_globals and magic_quotes have been removed, but configurations that trust input values or expose errors as-is remain problematic today.

Injection Types

The most common type is SQL injection. When user input is placed into queries through string concatenation, authentication bypass and data leakage occur. Prepared statements and binding, and safe use of ORMs, are the basic countermeasures. Command injection, where input is passed to OS command execution functions, XSS, where HTML output is not escaped, and header, log, and LDAP injection are also major categories.

File and Path Vulnerabilities

When user input enters include/require, local file inclusion (LFI) and remote file inclusion (RFI) can occur. Path traversal, dangerous file uploads, and the absence of extension and MIME validation also lead to server compromise. For file uploads, the storage location should be outside the web root, and allowed extensions and execution permissions should be separated.

Deserialization and Object Injection

When untrusted data is passed to unserialize(), object injection and RCE abusing magic methods are possible. phar:// metadata deserialization is also dangerous when combined with file functions. External data should be exchanged in safe formats such as JSON, and when unavoidable, signatures, whitelists, and class restrictions should be applied.

Authentication, Sessions, and APIs

Session fixation, unset cookie attributes, weak password hashes, and missing JWT validation lead to account takeover. Session ID regeneration, HttpOnly, Secure, and SameSite cookies, use of password_hash(), and validation of JWT alg, iss, and aud are required. In REST APIs, mass assignment, IDOR, and SSRF should also be checked.

Configuration and Runtime Vulnerabilities

Exposure of display_errors, enabling allow_url_include, unset open_basedir, and public PHP-FPM status pages lead to information disclosure and expanded attacks. Because disable_functions alone can be bypassed, minimizing OS privileges and container isolation must be applied together. In 2024, an argument injection vulnerability in Windows PHP-CGI environments (CVE-2024-4577) was exploited for remote code execution, highlighting the importance of configuration and patching.

Dependencies and Supply Chain

Known vulnerabilities can enter through Composer packages and framework dependencies. Attention must be paid to abandoned packages, typosquatting, dependency confusion, and compromised distribution scripts, and composer audit, SBOM, version pinning, and integrity verification should be applied.

Response Strategies

Input validation and output escaping, least privilege, prepared statements, whitelists, safe deserialization, and upload isolation are key. SAST, DAST, SCA, code review, penetration testing, WAF, and log monitoring should be operated in layers, and PHP, extension modules, and frameworks must be kept on versions that receive the latest security support.

Latest Trends

As of 2024-2025, security support for PHP 8.1 is nearing its end, making migration to 8.2, 8.3, and 8.4 important, and PHP 8.4 was released in November 2024, becoming an option for new projects. After the Windows PHP-CGI RCE (CVE-2024-4577), checks on CGI/FPM configuration exposure and argument handling were strengthened. As Composer supply chain attacks and container and Kubernetes configuration errors emerge as major threats, SBOM, automated dependency scanning, and CI/CD security gates are trending toward standardization. AI-based code review and automated patch suggestions are also spreading, but because WAF alone can be bypassed, secure coding and rapid patching remain priorities.