PHP 7.2.16 is running on approximately 835 active websites worldwide, but this version contains 6 significant security vulnerabilities—including 1 critical flaw that could allow attackers to execute unauthorized access through image file processing. The vulnerabilities primarily affect the EXIF component, which handles metadata from digital photos and images uploaded to your site. If your website hasn't been patched beyond PHP 7.2.16, you're exposing your server and user data to serious security risks that exploit image file handling, filesystem operations, and uninitialized memory reads.
In this guide, we'll explain what these vulnerabilities are, how to check if your site is affected, and provide step-by-step instructions to upgrade and protect your PHP installation. Understanding these risks is crucial for website owners, developers, and system administrators who want to maintain a secure online presence.
PHP 7.2.16 is a server-side programming language version released in March 2019 that powers the backend functionality of millions of websites. Think of it as the engine that runs your website—it processes form submissions, manages databases, handles file uploads, and delivers dynamic content to your visitors. PHP 7.2 was one of the most widely adopted versions of the language before it reached end-of-life, making it common in older WordPress sites, custom applications, and legacy e-commerce platforms.
However, PHP 7.2.16 specifically was released before several critical security patches became available. The version contains multiple flaws in how it processes image files and manages filesystem operations. When you upload a photo or image to a website running this version, the server could improperly handle that file's metadata (EXIF data), potentially exposing sensitive information or allowing attackers to trigger uninitialized memory reads that lead to information disclosure or system compromise.
6 CVEs found. The most critical are explained below.
When your website processes photo files, PHP can crash or leak hidden information from the image's metadata. This happens because the software doesn't properly check the data before reading it. Attackers can upload specially crafted photos to trigger this problem.
Impact: Your website could become unavailable, or attackers could extract sensitive information stored in image files without permission.
↗ View on NVDWhen your server moves or renames files between different storage locations, there's a brief moment where file permissions aren't properly set. During this window, unauthorized people could potentially access files they shouldn't see.
Impact: Attackers could read private files like configuration files containing passwords or customer data during the brief window when permissions are incorrect.
↗ View on NVDWhen processing camera-specific metadata embedded in photos, PHP incorrectly handles the relationship between different data values. This causes the software to read from the wrong memory location, which can crash your site or expose data.
Impact: Website crashes or exposure of server memory contents, which could reveal passwords, database information, or other sensitive data.
↗ View on NVDSimilar to the previous issue, the PHP photo metadata processor mishandles certain data variables, causing it to read uninitialized memory. Attackers upload malicious photos to trigger this vulnerability.
Impact: Server memory exposure that could leak sensitive information, or website crashes that disrupt service for your visitors.
↗ View on NVDPHP's photo processing component incorrectly reads JPEG file data, accessing memory regions it shouldn't touch. Attackers can upload specially formatted JPEG files to exploit this.
Impact: Website crashes or potential exposure of server memory containing sensitive information like encryption keys or user data.
↗ View on NVDIf you used PHPKB (a knowledge base software) and left installation files in place, attackers could access the installation test script to read your database files without logging in. This affects PHP versions before 7.2.16.
Impact: Complete exposure of your database containing all customer information, passwords, and business data to anyone on the internet.
↗ View on NVDScan your site in 30 seconds. Used by 500+ web agencies.
PHP 7.2.16's security vulnerabilities represent a significant risk to your website's integrity and your visitors' data. The critical EXIF processing flaw (CVE-2019-9641) and five additional high-severity vulnerabilities can be exploited through image uploads, filesystem operations, and specially crafted requests—all common attack vectors used by cybercriminals. Upgrading to a patched version is not optional; it's a fundamental requirement for responsible website management.
Don't leave your website vulnerable another day. Use SiteRecipe.com's comprehensive vulnerability scanner to identify all security issues on your site, receive detailed upgrade recommendations, and track your patch compliance over time. Our platform monitors PHP versions, CVEs, and deprecated features, giving you the insights needed to keep your website secure, fast, and compliant. Start your free security audit today and take control of your website's protection.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.