CVE-2018-20783: In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read i...

Security readout for executives and security teams

This is a PHP memory-safety flaw in PHAR archive parsing. If an affected PHP runtime tries to parse a crafted .phar file, PHP may read memory beyond the intended data. The main concern is information exposure or instability in systems that process untrusted PHAR archives. Exposure is most likely on legacy PHP systems that parse, upload, inspect, or otherwise handle .phar archives from untrusted or semi-trusted sources. Systems already updated past the named fixed releases are less likely exposed. Treat as a targeted legacy-platform remediation item, not an emergency based on current evidence. Prioritize systems that process user-supplied archives or still run old PHP branches. Mitigation focus: Upgrade PHP to the fixed release line named for your deployed version.; Apply relevant distribution security updates from Ubuntu, openSUSE, Red Hat, or your vendor.; Avoid parsing untrusted .phar files until affected runtimes are patched..

Prepared

Jun 6, 2026, 21:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.