{"action":"Upgrade phpunit/phpunit to 8.5.52 or later.","affected":[{"fixed":"8.5.52","introduced":"0"},{"fixed":"9.6.33","introduced":"9.0.0"},{"fixed":"10.5.62","introduced":"10.0.0"},{"fixed":"11.5.50","introduced":"11.0.0"},{"fixed":"12.5.8","introduced":"12.0.0"}],"component":"phpunit/phpunit","cve_ids":["CVE-2026-24765"],"ecosystem":"Packagist","epss":0.00384,"exploited":false,"fixed_versions":["8.5.52","9.6.33","10.5.62","11.5.50","12.5.8"],"ghsa_id":"GHSA-vvj3-c3rp-c85p","id":"tcs_01M5KF9FSYGAZCYE94T2A429SA","modified_at":"2026-05-05T15:55:47.547809Z","published_at":"2026-01-27T22:26:22Z","references":["https://osv.dev/vulnerability/GHSA-vvj3-c3rp-c85p","https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-vvj3-c3rp-c85p","https://nvd.nist.gov/vuln/detail/CVE-2026-24765","https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda","https://github.com/sebastianbergmann/phpunit/commit/613d142f5a8471ca71623ce5ca2795f79248329e","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpunit/phpunit/CVE-2026-24765.yaml","https://github.com/sebastianbergmann/phpunit","https://github.com/sebastianbergmann/phpunit/releases/tag/10.5.63","https://github.com/sebastianbergmann/phpunit/releases/tag/11.5.50","https://github.com/sebastianbergmann/phpunit/releases/tag/12.5.8","https://github.com/sebastianbergmann/phpunit/releases/tag/8.5.52","https://github.com/sebastianbergmann/phpunit/releases/tag/9.6.33","https://lists.debian.org/debian-lts-announce/2026/02/msg00009.html","https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-04-Poisoned-Pipeline-Execution"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-vvj3-c3rp-c85p","url":"https://osv.dev/vulnerability/GHSA-vvj3-c3rp-c85p"}],"summary":"PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling"}