GHSA-76px-r497-93p9: 
PHP Análise e mitigação de vulnerabilidades

The iOS asset handler (PHPSchemeHandler) and the Android equivalent (PHPWebViewClient) built a filesystem path under the app's public/ directory from the URL path after /_assets without removing ... A crafted request such as /_assets/../<path> escaped public/ and read other files in the app sandbox. Because this is served on the app's own origin, a page can read arbitrary in-sandbox files directly, with no second primitive and without needing the absolute container path. The concrete target is the SQLite database. It is read-only — no write or denial-of-service — but it is the most direct of the file-read findings. Fix. The resolved asset path is canonicalised and confined to public/; requests that escape it are refused. Older lines. 1.x and 2.x are end-of-life and will not be patched; upgrade to v4 (>= 4.6.1). Note. This includes native (Swift/Kotlin/C) changes, which only reach an installed app after native:install --force and a rebuild. Update the Composer package and rebuild the app.

Acknowledgments

Discovered by the researcher acd421 and reported in good faith by RedEye Security. Write-up: https://threat-intelligence.redeyesecurity.com/blog/php2shell-part-two-surviving-php-flaws-2026