New Vulnerability in PHP's extract() Function Allows Arbitrary Code Execution

19 Apr 2025

VulnerabilitiesCode ExecutionPHPCybersecurity

A new report describes a vulnerability in the extract() function of PHP that allows attackers to trigger a double-free. This vulnerability can then enable the execution of arbitrary code (native code).

Read the original article on reddit.com

New Vulnerability in PHP's extract() Function Allows Arbitrary Code Execution | Cyber Hub