PHP 7.2.17 is running on 928 websites worldwide, but it contains two critical security vulnerabilities that could expose your site to serious attacks. These flaws exist in the EXIF extension—a common tool used to read image metadata—and can allow attackers to access sensitive information or crash your server. If your website uses PHP 7.2.17, this is a critical security issue that demands immediate attention.
The two vulnerabilities, CVE-2019-11034 and CVE-2019-11035, both involve buffer overflow attacks in the EXIF processing functions. When your server processes certain malicious image files, an attacker can read data beyond the allocated memory buffer, potentially exposing confidential information or causing your site to crash. Even if you think your site isn't targeted, automated scanning tools continuously probe servers for these exact vulnerabilities.
This guide walks you through understanding these vulnerabilities, checking if your site is affected, and implementing fixes to protect your website and users.
PHP 7.2.17 is a server-side programming language that powers millions of websites. It's installed on web servers and handles the behind-the-scenes logic that makes websites function—processing forms, accessing databases, and generating the pages you see in your browser. PHP 7.2.17 specifically is an older version released in May 2018, and many websites still run it because updating can seem complicated or risky.
The EXIF extension mentioned in these vulnerabilities is a PHP tool that reads metadata from image files—think of it as extracting the invisible information stored inside photos, like the camera model or date taken. Most websites that handle image uploads (like portfolio sites, e-commerce stores, or social platforms) use this extension. When PHP 7.2.17's EXIF functions process certain specially crafted images, they can malfunction and expose sensitive server data or crash entirely.
2 CVEs found. The most critical are explained below.
PHP has a flaw in how it reads photo metadata (EXIF data) from image files. When someone uploads a specially crafted photo, the software can accidentally read memory it shouldn't access. This is like leaving a door open in your filing cabinet that lets people peek at confidential files.
Impact: An attacker could cause your website to crash or steal sensitive information from your server's memory, potentially exposing customer data or database information.
↗ View on NVDSimilar to the first issue, PHP incorrectly handles photo metadata in another part of the code. A malicious image file can trick the system into reading beyond safe memory boundaries. This creates an unguarded window into your server's private information.
Impact: Your website could crash unexpectedly or sensitive server data could be exposed to attackers who upload specially designed images.
↗ View on NVDScan your site in 30 seconds. Used by 500+ web agencies.
PHP 7.2.17 vulnerabilities are not theoretical threats—928 websites are currently exposed, and cybercriminals actively scan for these exact flaws. The good news is that upgrading takes hours, not days, and modern PHP versions are faster and more secure than older ones. Your website's performance and your users' safety depend on keeping your server software current.
Don't wait for a breach to force your hand. Use SiteRecipe.com's website security monitoring tools to automatically detect outdated software, vulnerability exposure, and security gaps on your site. Our platform scans your PHP version, checks for known CVEs, and alerts you before hackers find them. Start a free security audit on SiteRecipe.com today and take control of your site's safety.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.