Remote Code Execution Vulnerability in PHPUnit Testing Framework
CVE-2026-24765
What is CVE-2026-24765?
A serious security issue has been identified in PHPUnit, a popular testing framework for PHP. The vulnerability arises from unsafe deserialization of code coverage data during PHPT test execution. Specifically, the cleanupForCoverage() method improperly deserializes code coverage files without adequate validation, potentially allowing attackers to execute arbitrary code if malicious .coverage files are present. This situation typically occurs when an attacker with local file write access manipulates the filesystem to introduce a malicious serialized object. Starting with the fixed versions, PHPUnit will clearly indicate any pre-existing .coverage files before execution, helping organizations adjust their CI/CD configurations and implement best practices to mitigate the risk.
Affected Version(s)
phpunit < 8.5.52 < 8.5.52
phpunit >= 9.0.0, < 9.6.33 < 9.0.0, 9.6.33
phpunit >= 10.0.0, < 10.5.62 < 10.0.0, 10.5.62