Skip to content

v0.1.2: primary-source advisories

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Oct 20:51
· 15 commits to main since this release
v0.1.2
a706350
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

The fix table is now confirmed against PHP's own advisories, and the docs say exactly what those advisories do and do not cover. No change in detection behavior.

  • Primary sources. GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) both list 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the patched releases. They are now the first references in the tool, in the SARIF help links, in the README and on the site. The newest official php Docker image in each branch matches.
  • Honest wording about older branches. PHP's advisories cover 8.2 to 8.5 only. The README, site and code now say the PHP 5.4 start of the affected range is Sansec's claim, and advise treating 8.1 and older as vulnerable unless the vendor changelog names both CVEs.
  • Copyright holder is Ethoic Inc; Code of Conduct added.
  • Tests: 91 to 95, including an invariant test that PATCHED never appears without evidence.

Download php_vuln_check.py below (single file, no dependencies) and check it against SHA256SUMS, or pipx install git+https://github.com/ethoic-inc/php-vuln-check.

Assets 6
Loading