CVE-2026-24765: PHPUnit RCE Vulnerability

CVE-2026-24765 Overview

CVE-2026-24765 is an unsafe deserialization vulnerability in PHPUnit, a widely used testing framework for PHP. The flaw resides in the cleanupForCoverage() method, which deserializes .coverage files during PHPT test execution without the allowed_classes parameter restriction. An attacker with local file write access to the coverage file location can stage a malicious serialized object containing a __wakeup() method. When PHPUnit runs tests with code coverage instrumentation enabled, the crafted object triggers arbitrary code execution. The issue is tracked under [CWE-502: Deserialization of Untrusted Data].

Critical Impact

Local attackers with write access to coverage file paths can achieve arbitrary code execution in CI/CD pipelines and developer environments running PHPUnit with coverage enabled.

Affected Products

• PHPUnit versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52
• Debian Linux 11.0 (phpunit package)
• PHP applications and CI/CD pipelines invoking PHPT tests with code coverage instrumentation

Discovery Timeline

• 2026-01-27 - CVE-2026-24765 published to NVD
• 2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-24765

Vulnerability Analysis

The vulnerability stems from how PHPUnit handles pre-existing .coverage files during PHPT test execution. The cleanupForCoverage() method calls PHP's unserialize() on file contents without specifying ['allowed_classes' => false]. PHP's deserialization will then instantiate any class declared in the serialized payload and invoke magic methods such as __wakeup() or __destruct(). Attackers can chain existing application or dependency classes into a POP (Property-Oriented Programming) gadget chain to execute arbitrary code. Exploitation requires the attacker to write a malicious .coverage file to a location PHPUnit reads from before tests run.

Root Cause

The root cause is missing input validation on serialized data. The cleanupForCoverage() method assumed .coverage files would only ever be written by PHPUnit itself. It did not enforce the allowed_classes restriction available in PHP's unserialize() API. Because PHPT test runs expect no pre-existing coverage file, the presence of one represents an anomalous state that the original code silently consumed instead of rejecting.

Attack Vector

Exploitation requires local file write access to the directory where PHPUnit stores or expects PHPT code coverage files. Plausible attack paths include compromised CI/CD pipelines with shared runners, malicious or compromised third-party dependencies, and multi-tenant developer environments. The attacker plants a crafted .coverage file containing a serialized object referencing a gadget class with a dangerous __wakeup() or __destruct() implementation. When a developer or pipeline triggers phpunit with coverage instrumentation enabled, the gadget chain fires and executes arbitrary PHP code under the privileges of the test runner.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-vvj3-c3rp-c85p and the upstream commit for the precise fix details.

Detection Methods for CVE-2026-24765

Indicators of Compromise

• Presence of .coverage files in PHPT test directories prior to a test run starting
• Unexpected child processes spawned by phpunit or PHP CLI during test execution
• Outbound network connections originating from CI/CD runners during the test phase
• Modifications to source files, SSH keys, or CI secrets immediately after a phpunit invocation

Detection Strategies

• Audit installed PHPUnit versions across developer workstations, build agents, and container images against the patched releases
• Hash and inventory all .coverage files produced by CI builds, alerting on files that appear before phpunit execution begins
• Inspect pipeline logs for the new explicit error message emitted by patched PHPUnit when a stale .coverage file is detected
• Monitor for serialized PHP object signatures (strings beginning with O: followed by class names) inside files in coverage output directories

Monitoring Recommendations

• Enable process and file integrity monitoring on CI/CD runners, especially around the workspace and temporary directories used by PHPUnit
• Collect and centralize build logs for retroactive search against known indicators tied to CVE-2026-24765
• Alert on writes to .coverage paths by any process other than phpunit itself

How to Mitigate CVE-2026-24765

Immediate Actions Required

• Upgrade PHPUnit to 12.5.8, 11.5.50, 10.5.62, 9.6.33, or 8.5.52 depending on the supported branch in use
• Apply the Debian LTS update referenced in the Debian LTS announcement for Debian 11 systems
• Scrub all coverage output directories on CI/CD runners and developer machines before the next test run
• Rotate any credentials, tokens, or signing keys exposed to potentially affected pipelines

Patch Information

The maintainer chose to treat pre-existing .coverage files for PHPT tests as an explicit error rather than silently sanitizing input. Starting with versions 12.5.8, 11.5.50, 10.5.62, and 9.6.33, PHPUnit emits a clear error message when it detects an anomalous pre-existing .coverage file. Patched releases are available on GitHub: PHPUnit 12.5.8, PHPUnit 11.5.50, PHPUnit 10.5.63, PHPUnit 9.6.33, and PHPUnit 8.5.52. The upstream fix is captured in commit 3141742e.

Workarounds

• Use ephemeral CI/CD runners that are destroyed after each job to eliminate persistent attacker-staged files
• Disable code coverage instrumentation on untrusted branches or pull requests from forks
• Enforce branch protection, mandatory code review, and artifact isolation between jobs to limit dependency tampering
• Restrict file system permissions so only the CI user can write to the PHPUnit coverage directory, and clear that directory at job start

# Configuration example
# Upgrade PHPUnit via Composer to a patched release
composer require --dev phpunit/phpunit:^12.5.8

# Pre-job cleanup to remove any stale or attacker-planted coverage files
find . -type f -name '*.coverage' -print -delete

# Run tests with coverage only after verifying the workspace is clean
vendor/bin/phpunit --coverage-text