ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

PHP-FPM logs from children may be altered

cgi.force_redirect configuration is bypassable due to the environment variable collision

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

Erroneous parsing of multipart form data

PHP is vulnerable to the Marvin Attack

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

Filter bypass in filter_var (FILTER_VALIDATE_URL)

Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that a…

Underflow in PHP-FPM can lead to RCE