Vulnerabilities & Exploits · Web App Attack
The risky assumption is that an old CVE is low priority because it is old. In this case, the real exposure is not the framework version alone but public test artifacts like eval-stdin.php left on live web servers, which still give attackers a code execution path years after disclosure.
VulnCheck says it saw more than 80,000 exploitation attempts in 30 days and 36,500 in the last 10 days, with scanning getting more sophisticated. The issue affects PHPUnit versions before 4.8.28 and 5.x before 5.6.3, and the vulnerable file is eval-stdin.php in the PHPUnit test tree.
Patch level alone does not close the door if that file is still reachable on the web. The lasting risk is inherited development debris in production, which keeps a once-public test helper in active attack range.
1 source · May 15
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary… EPSS 100% (100th percentile).
CISA federal remediation date Aug 15 · date passed
VulnCheck
9 Year-Old PHP Vulnerability Keeps Swinging As One of the Most Targeted Vulnerabilities | Blog | VulnCheck
CVE-2017-9841 is still a primary exploit path for several botnets.
originalPart of the PlainSec briefing for 2026-05-18
Every edition of this story: Stray PHPUnit Test Files Keep Exposing Production Servers