Live › vulnerability › CVE-2017-9841
Go to dashboardPHPUnit's eval-stdin.php script executes any PHP code sent in an HTTP POST body that starts with "<?php ". An attacker who can reach that file over the web runs arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PHPUnit PHPUnit | vendor | – | – |
Check whether a web-reachable path exposes /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php, for example: curl -I https://your-site/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Check whether phpunit is installed in production: composer show phpunit/phpunit
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2017-9841")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.