Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-28 | 1 | Disclosure1 |
| 2026-07-14 | 2 | Disclosure2 |
CVE-2026-45077 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener… https://www.cve.org/CVERecord?id=CVE-2026-45077
Post summary
The post informs that Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12 are vulnerable due to an issue in the server:log listener, and provides a link to the CVE record.
🚨*CVE* CVE-2026-45077 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener… https://www.cve.org/CVERecord?id=CVE-2026-45077 ----- Traducción: CVE-2026-45077 Sym… http://infoflow.cloud`
Post summary
The post references CVE-2026-45077, noting affected Symfony versions and the server:log listener component, but offers no PoC, exploit code, active exploit report, or patch information.
🚨 High-Severity Unauthenticated PHP Object Deserialization in Symfony (CVE-2026-45077) The server:log command (part of MonologBridge) listens on 0.0.0.0:9911 by default and blindly performs unserialize(base64_decode()) on incoming messages with no authentication and no class allowlist. This allows remote attackers to send malicious serialized objects — potentially leading to RCE or DoS if gadget chains are available. 👉Affected: symfony/monolog-bridge & symfony/symfony >5.4.52 , >6.4.40 , >7.4.12 , >8.0.12| Fixed: 5.4.52 / 6.4.40 / 7.4.12 / 8.0.12
Post summary
New high-severity, unauthenticated PHP object deserialization flaw disclosed in Symfony’s MonologBridge; vulnerable command accepts base64-encoded payloads on port 9911 and can lead to RCE or DoS, with patches already released.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sensiolabs | symfony | - | - | - |