CVE-2026-24765

Packagist/phpunit/phpunit CVE-2026-24765: high 7.8, EPSS 0.38%

PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling

Action: Upgrade phpunit/phpunit to 8.5.52 or later.

composer require phpunit/phpunit:8.5.52

composer require phpunit/phpunit:9.6.33

composer require phpunit/phpunit:10.5.62

composer require phpunit/phpunit:11.5.50

composer require phpunit/phpunit:12.5.8

Affected

Fixed versions

Sources

• osv: GHSA-vvj3-c3rp-c85p
• https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p
• https://nvd.nist.gov/vuln/detail/CVE-2026-24765
• https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda
• https://github.com/sebastianbergmann/phpunit/commit/613d142f5a8471ca71623ce5ca2795f79248329e
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-24765.yaml
• https://github.com/sebastianbergmann/phpunit
• https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63
• https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50
• https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8
• https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52
• https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33
• https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html
• https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution

CVE-2026-24765 · published 2026-01-27T22:26:22Z · modified 2026-05-05T15:55:47.547809Z · JSON