GHSA-9884-fw9c-mq85: 
PHP Análise e mitigação de vulnerabilidades

routes/api.php is registered with no middleware, so script running on the app's own origin (an XSS, or a bundled/compromised third-party script) can POST to /_native/api/call and reach any registered bridge function. Two async functions trusted that input:

• The dispatched task id is spliced into a PHP string that the async lane evaluates, so a task id that is not a UUID could inject code into that lane.
• AsyncTask.Complete, and the dispatch timeout event, let the caller post an arbitrary event name and payload into a native screen's runloop (for example a navigation event, or a result a screen was waiting on). These share one root cause and one fix, so they are reported together. Fix. The task id must be a UUID before it reaches the lane (Swift, Kotlin and the C lane). AsyncTask.Complete is answered only on an async-lane thread. The timeout path always posts the fixed failure event with the task's own id. The web view bridge controller refuses the AsyncTask. prefix. The controller check ships in the Composer package; the native checks require a rebuild. Only affects 4.5.0+. Workaround. Until upgraded, avoid shipping untrusted or third-party JavaScript in the app's web view.

Acknowledgments

Discovered by the researcher acd421 and reported in good faith by RedEye Security. Write-up: https://threat-intelligence.redeyesecurity.com/blog/php2shell-part-two-surviving-php-flaws-2026