{"vulnerability": "CVE-2026-6735", "sightings": [{"uuid": "0e82f39f-6139-4013-8d3f-1258be17509e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6735", "type": "seen", "source": "https://bsky.app/profile/remirepo.net/post/3mlczxuq7ac2w", "content": "\ud83d\udee1\ufe0f Security updates:\n\n- php-8.1.34-2 (in the php:remi-8.1 module)\n- php80-php-8.1.34-2 (in the php81 Software Collection)\n\nWith security fixes backported from 8.2.31 (CVE-2026-6735, CVE-2026-7259, CVE-2025-14179, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258)", "creation_timestamp": "2026-05-08T05:51:08.392379Z"}, {"uuid": "563db53f-a381-43f2-bac0-83fe0267c3ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6735", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mldbca2ylb2w", "content": "7/18\n\nrange comparison.\n  For more information, see:\n    https://www.php.net/ChangeLog-8.php#8.4.21\n    https://www.cve.org/CVERecord?id=CVE-2026-7263\n    https://www.cve.org/CVERecord?id=CVE-2026-6735\n    https://www.cve.org/CVERecord?id=CVE-2026-7259", "creation_timestamp": "2026-05-08T08:02:11.593370Z"}, {"uuid": "2dcdcb14-7f42-447a-8ff6-dfcb2b7ce218", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6735", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116549460028714689", "content": "\u26a0\ufe0f HIGH-severity XSS (CVE-2026-6735) impacts PHP 8.2 \u2013 8.5: improper input handling on PHP-FPM status page enables JavaScript injection via crafted URLs. Restrict access & watch for updates. https://radar.offseq.com/threat/cve-2026-6735-cwe-79-improper-neutralization-of-in-fbc11f41 #OffSeq #PHP #XSS #AppSec", "creation_timestamp": "2026-05-10T09:00:26.635341Z"}, {"uuid": "c6051a56-56ae-4f63-92af-06ef725ef833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-6735", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mlifibowxv2o", "content": "PHP 8.2 \u2013 8.5 hit by HIGH-severity XSS (CVE-2026-6735) on PHP-FPM status page. Restrict access, avoid suspect URLs, and monitor for patches. Details: https://radar.offseq.com/threat/cve-2026-6735-cwe-79-improper-neutralization-of-in-fbc11f41 #OffSeq #PHP #AppSec", "creation_timestamp": "2026-05-10T09:00:29.086585Z"}, {"uuid": "21fce91d-a251-4dc4-bb80-f53d83c58747", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6735", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mliabflkve2e", "content": "CVE-2026-6735 - XSS within PHP-FPM status endpoint\nCVE ID : CVE-2026-6735\n \n Published : May 10, 2026, 5:16 a.m. | 1\u00a0hour, 12\u00a0minutes ago\n \n Description : In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitat...", "creation_timestamp": "2026-05-10T07:27:08.714099Z"}, {"uuid": "325b1920-8ef0-488f-a8a7-3df41d9f365d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6735", "type": "seen", "source": "https://bsky.app/profile/remirepo.net/post/3mlkr672pc225", "content": "\ud83d\udee1\ufe0f Security updates:\n\n- php-8.0.30-16 (in the php:remi-8.0 module)\n- php80-php-8.0.30-16 (in the php80 Software Collection)\n\nWith security fixes backported from 8.1.34 (CVE-2026-6735, CVE-2026-7259, CVE-2025-14179, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258)", "creation_timestamp": "2026-05-11T07:34:54.548141Z"}, {"uuid": "3921ce4a-e1f7-4c68-9f2f-e1c6c0afb222", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6735", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mllakdpahl2k", "content": "\ud83d\udd17 CVE : CVE-2025-14179, CVE-2026-42371, CVE-2026-6104, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258, CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7263, CVE-2026-7568", "creation_timestamp": "2026-05-11T12:10:08.997052Z"}, {"uuid": "52c81761-bcc8-490f-9545-ec860e015ea1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6735", "type": "seen", "source": "https://bsky.app/profile/remirepo.net/post/3mlnbxdu4qk2i", "content": "\ud83d\udee1\ufe0f Security updates:\n\n- php-7.4.33-26 (in the php:remi-7.4 module)\n- php74-php-7.4.33-26 (in the php74 Software Collection)\n\nWith security fixes backported from 8.1.34 (CVE-2026-6735, CVE-2026-6722, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568, CVE-2026-7258)", "creation_timestamp": "2026-05-12T07:40:37.923573Z"}, {"uuid": "e60852e6-1884-4178-af58-f0f8792edcc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6735", "type": "seen", "source": "https://bsky.app/profile/remirepo.net/post/3mm6zzbf6i22m", "content": "\ud83d\udee1\ufe0f Security update:\n\nSoftware Collections:\n- php56-php-5.6.40-46\n\nWith some recent important security fixes backported from 8.2.31 (CVE-2026-6735, CVE-2026-7261, CVE-2026-7262)", "creation_timestamp": "2026-05-19T09:06:28.221497Z"}]}