CVE-2026-24765Disclosure(debian / debian_linux)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch debian debian_linux systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists in the `cleanupForCoverage()` method, which deserializes code coverage files without validation, potentially allowing remote code execution if malicious `.coverage` files are present prior to the execution of the PHPT test. The vulnerability occurs when a `.coverage` file, which should not exist before test execution, is deserialized without the `allowed_classes` parameter restriction. An attacker with local file write access can place a malicious serialized object with a `__wakeup()` method into the file system, leading to arbitrary code execution during test runs with code coverage instrumentation enabled. This vulnerability requires local file write access to the location where PHPUnit stores or expects code coverage files for PHPT tests. This can occur through CI/CD pipeline attacks, the local development environment, and/or compromised dependencies. Rather than just silently sanitizing the input via `['allowed_classes' => false]`, the maintainer has chosen to make the anomalous state explicit by treating pre-existing `.coverage` files for PHPT tests as an error condition. Starting in versions in versions 12.5.8, 11.5.50, 10.5.62, 9.6.33, when a `.coverage` file is detected for a PHPT test prior to execution, PHPUnit will emit a clear error message identifying the anomalous state. Organizations can reduce the effective risk of this vulnerability through proper CI/CD configuration, including ephemeral runners, code review enforcement, branch protection, artifact isolation, and access control.

debian CVEs Back to dashboard

1.3/ 10 priority

Sources & remediation

Patch / fix

https://github.com/sebastianbergmann/phpunit/commit/3141742e00620e2968d3d2e732d320de76685fda

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

debian_linux
phpunit

Threat summary

Patch or workaround signal is available
11 mentions across 8 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 10 signals
Disclosure: 7 classified signals
General: 2 classified signals
Peaked 5d ago at 3 mentions (2026-01-29); latest day: 1
11 total mentions across 8 days

Affected systems

Vendors

debian phpunit_project

Products

debian_linuxphpunit

1 version affected across 2 products

Deep dive

Activity timeline11 mentions / 8d

Signal classification3 categories

Disclosure

763.6%

Patch

218.2%

General

218.2%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-27	2	Disclosure2
2026-01-28	1	Disclosure1
2026-01-29	3	Disclosure2Patch1
2026-02-03	1	Disclosure1
2026-02-05	1	General1
2026-02-06	1	Patch1
2026-04-18	1	Disclosure1
2026-04-23	1	General1

Full discourse11 posts

kokumօtօ@__kokumoto252d
Patch
PHPUnitに深刻な脆弱性。CVE-2026-24765はCVSSスコア7.8の遠隔コード実行。cleanupForCoverage()がコードカバレッジファイルを検証しないままデシリアライズするのが悪い。悪用にはローカルファイルへの書き込みが前提。修正版提供あり。 https://securityonline.info/cve-2026-24765-phpunit-vulnerability-exposes-ci-cd-pipelines-to-rce/
Post summary
The text reports a remote code execution vulnerability in PHPUnit (CVE-2026-24765) with a CVSS score of 7.8, outlines the technical details of the flaw, and confirms that a patch has been provided.
010401.1K
7.2K followersView on X
T.MOTOOKA@t_motooka168d
General
PHPUnitの CVE-2026-24765 の脆弱性、テスト実行時に特定のローカルファイルが置かれていたら任意コード実行あるかも、という話だけれども… 意図しないファイルがローカルの所定場所に置かれる状況であって、まだ任意コード実行されてない状況、というのがどういうものなのか、今の私はわかってない😅
Post summary
The post notes a potential code‑execution flaw in PHPUnit CVE‑2026‑24765 but lacks concrete evidence, patches, or exploitation details.
10000160
1.5K followersView on X
DailyCVE@dailycve173d
Disclosure
🔴 PHPUnit, INI Injection, #CVE-2026-24765 (Critical) https://dailycve.com/phpunit-ini-injection-cve-2026-24765-critical/
Post summary
The post announces the critical PHPUnit INI injection vulnerability (CVE-2026-24765) without providing PoC, exploit details, or patch information.
0001061
181 followersView on X
Yves@IsiteYves247d
Disclosure
🧵 🚨Security Alert for PHP developers using PHPUnit! A high-severity vulnerability (CVE-2026-24765) is reported in PHPUnit. If your CI/CD runs PHPT tests with code coverage, an attacker could achieve Remote Code Execution. #php #security #infosec
Post summary
A high‑severity vulnerability (CVE‑2026‑24765) in PHPUnit that allows RCE when PHPT tests run with code coverage has been disclosed, though no PoC, exploit, patch, or active exploitation details are provided.
1000041
42 followersView on X
Vijay Chauhan@mr_vijaychauhan252d
Disclosure
🚨 PHPUnit Security Advisory (High severity) CVE-2026-24765 affects PHPUnit code coverage handling via unsafe deserialization in PHPT tests. If you run PHPUnit in CI or locally, this matters. Details and fixes below 👇 #PHP #PHPUnit #Security https://t.co/2H5HqVU6xM
Post summary
PHPUnit is vulnerable to unsafe deserialization in PHPT tests, impacting code coverage handling; a fix is referenced in the advisory.
10000197
52 followersView on X
Ferramentas Linux@Cezar_H_Linux244d
Patch
Critical reading for PHP developers and security teams: #Fedora 42's PHPUnit 12.5.8 update patches a severe deserialization vulnerability (CVE-2026-24765) that enables Poisoned Pipeline Execution attacks. Read more: 👉 https://tinyurl.com/39axvwnm #Security https://t.co/WVcifLFc6M
Post summary
The tweet announces that the latest PHPUnit 12.5.8 update for Fedora 42 patches CVE-2026-24765, a severe deserialization flaw that could lead to Poisoned Pipeline Execution attacks.
0000052
1.3K followersView on X
Ferramentas Linux@Cezar_H_Linux245d
General
#Fedora PHPUnit 12 Advisory: A Case Study in DevSecOps Urgency. The FEDORA-2026-470a48f838 advisory for CVE-2026-24765 is a textbook example of modern software supply chain risk. Read more: 👉 https://tinyurl.com/2x83mdze #Security https://t.co/PKURj18X3r
Post summary
The tweet references a Fedora advisory for CVE-2026-24765 but provides no technical details, exploit information, or mitigation steps, merely pointing to an advisory link.
0000056
1.3K followersView on X
Karma-X@Karma_X_Inc252d
Disclosure
CVE-2026-24765: PHPUnit Vulnerability Exposes CI/CD Pipelines to RCE https://securityonline.info/cve-2026-24765-phpunit-vulnerability-exposes-ci-cd-pipelines-to-rce/
Post summary
The text announces the PHPUnit CVE-2026-24765 vulnerability that enables RCE in CI/CD pipelines, but does not include details on PoC, exploit tools, or patch information.
0000054
72 followersView on X
CrowdCyber 🌐@CrowdCyber_Com252d
Disclosure
CVE-2026-24765: PHPUnit Vulnerability Exposes CI/CD Pipelines to RCE https://securityonline.info/cve-2026-24765-phpunit-vulnerability-exposes-ci-cd-pipelines-to-rce/
Post summary
The text announces CVE‑2026‑24765, a remote code execution vulnerability in PHPUnit that can expose CI/CD pipelines.
0000056
298 followersView on X
cvereports@_cvereports253d
Disclosure
CVE-2026-24765: The CI/CD Trojan Horse: Inside PHPUnit's Unsafe Deserialization A critical insecure deserialization vulnerability in PHPUnit's PHPT test runner allows local attackers to achieve Remote Code Execution (RCE) by crafting malicious coverag... https://cvereports.com/reports/CVE-2026-24765
Post summary
The post announces a critical insecure deserialization vulnerability (CVE‑2026‑24765) in PHPUnit’s PHPT runner that allows local attackers to achieve remote code execution, with no mention of PoC, exploit code, patches, or active exploitation.
0000057
29 followersView on X
CVE@CVEnew253d
Disclosure
CVE-2026-24765 PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deseria… https://www.cve.org/CVERecord?id=CVE-2026-24765
Post summary
A new unsafe deserialization vulnerability (CVE-2026-24765) affects multiple PHPUnit releases, but no PoC, exploit, active exploitation, or patch details are disclosed.
00000263
56.5K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	debian	debian_linux	11.0	-	-
App	phpunit_project	phpunit	-	-	-

Explore more

Back to dashboard debian CVEs phpunit_project CVEs debian_linux vulnerabilities

What researchers are saying

CVE-2026-24765

kokumօtօ[verified]@__kokumotoPatch

The text reports a remote code execution vulnerability in PHPUnit (CVE-2026-24765) with a CVSS score of 7.8, outlines the technical details of the flaw, and confirms that a patch has been provided.

Karma-X[verified]@Karma_X_IncDisclosure

The text announces the PHPUnit CVE-2026-24765 vulnerability that enables RCE in CI/CD pipelines, but does not include details on PoC, exploit tools, or patch information.

T.MOTOOKA@t_motookaGeneral

The post notes a potential code‑execution flaw in PHPUnit CVE‑2026‑24765 but lacks concrete evidence, patches, or exploitation details.

DailyCVE@dailycveDisclosure

The post announces the critical PHPUnit INI injection vulnerability (CVE-2026-24765) without providing PoC, exploit details, or patch information.

Yves@IsiteYvesDisclosure

A high‑severity vulnerability (CVE‑2026‑24765) in PHPUnit that allows RCE when PHPT tests run with code coverage has been disclosed, though no PoC, exploit, patch, or active exploitation details are provided.

Vijay Chauhan@mr_vijaychauhanDisclosure

PHPUnit is vulnerable to unsafe deserialization in PHPT tests, impacting code coverage handling; a fix is referenced in the advisory.

Ferramentas Linux@Cezar_H_LinuxPatch

The tweet announces that the latest PHPUnit 12.5.8 update for Fedora 42 patches CVE-2026-24765, a severe deserialization flaw that could lead to Poisoned Pipeline Execution attacks.

Ferramentas Linux@Cezar_H_LinuxGeneral

The tweet references a Fedora advisory for CVE-2026-24765 but provides no technical details, exploit information, or mitigation steps, merely pointing to an advisory link.